What are drive-by download attacks, and how do they work?

A drive-by download attack requires no meaningful interaction from the victim: a simple visit to a compromised website can be enough to trigger an infection. The scale of the threat is reflected in the recent NordLayer research: in the past 12 months, 82% of IT teams reported at least one browser-linked security incident. Understanding how these attacks work is the first step in preventing them.

Key takeaways

1. Drive-by download attacks install malicious code silently without user consent or action
2. These attacks are increasing, targeting vulnerable web pages with security weaknesses
3. A compromised website can infect visitors without requiring them to click anything
4. Threat actors use exploit kits to find weaknesses and trigger unauthorized downloads of harmful payloads
5. Malware installations happen in the background, often without users realizing it
6. Organizations can mitigate risks with strong security practices, patching, and real-time monitoring
7. Third-party components in web pages can introduce vulnerabilities, making them easier to exploit
8. Malware scanning and access controls help block drive-by download attacks

What are drive-by download attacks?

A drive-by download attack occurs when a user loads a web page that contains malicious code. Attackers use hidden scripts and exploit kits to take advantage of security flaws, delivering infections that run entirely in the background.

These attacks fall into 2categories. In the first, the user technically authorizes the download without realizing what it really is a seemingly routine action, such as clicking a link on a pop-up or installing what looks like trustworthy software, actually delivers malware. In the second, the download is fully unauthorized and completely invisible—the infection is triggered the instant a page loads automatically, which requires no action from the user.

Most victims don't realize an attack has happened until malware installs and starts causing damage. Web pages with outdated third-party components are prime targets. Once the harmful code executes, it can quickly deliver download payloads to endpoint users. Even legitimate websites can be dangerous if compromised.

How drive-by download attacks work

Drive-by download attacks unfold silently and in a matter of seconds. The process typically follows 5 stages:

1. Preparation. Threat actors design drive-by download attacks to exploit vulnerabilities in browsers, plug-ins, and outdated software. They begin by compromising a website or ad network, planting rogue code that lies in wait for visitors.
2. Scanning. Once a user loads the infected web page, the malicious script automatically scans the browser or any third-party software for security weaknesses.
3. Exploitation. If a vulnerability is found, exploit kits take over, silently executing malicious code and triggering a hidden download.
4. Installation. The malware installs in the background, often running unnoticed while it steals data or grants cybercriminals remote access.
5. Stealth. Since the entire process happens without any user interaction, infections are extremely difficult to detect before the damage is done.

Who is most at risk?

Anyone browsing the web can be exposed to a drive-by download. However, certain users and organizations face higher risks:

• People using outdated browsers or skipping security updates
• Users with weak browser settings allowing unauthorized downloads
• Companies with lax security policies, making endpoint users easy targets
• Employees with admin privileges who can trigger large-scale malicious installations

Many drive-by download attacks happen through a silent download—when a user visits a breached website, and malicious code installs automatically. Keeping browsers updated and restricting third-party software can reduce the risk of malware downloads.

Types of drive-by download attacks

1. Malicious advertising networks (Malvertising)

Malicious advertising networks, also known as “malvertising,” are a leading source of drive-by downloads. Threat actors inject harmful scripts into legitimate ad networks. When users load these ads, hidden code attempts to download malware. Even trusted websites can unknowingly serve these infected ads.

• Attackers exploit security vulnerabilities in ads to trigger unauthorized downloads
• Victims don't need to click on an ad—just viewing it can start the drive-by download attack
• Attack kits scan for weaknesses, delivering download payloads without warning

2. Cross-site scripting (XSS) through compromised websites

Cross-site scripting allows attackers to inject malicious scripts into an infected website. When users visit, the script triggers an unintentional download.

• XSS attacks blend into normal site content, making them hard to detect
• Threat actors insert malicious code into user-generated pages, forums, or comment sections
• Poor input validation allows these scripts to stay active for months, infecting visitors

3. Automated exploit kit attacks

Exploit kits scan a visitor's device for known vulnerabilities. Once they find one, they deliver a hidden script that installs harmful software.

• Common attack kits include RIG and Fallout, which automate attacks
• The kit selects the best vulnerability to exploit, maximizing its success
• Malware installs silently, often granting remote control to cybercriminals

4. Watering hole attacks

In a watering hole attack, threat actors compromise websites frequently visited by a specific target group, such as members of a particular industry. Then the attackers infect the site with malicious code and wait for their victims to visit, much like a predator lurking near a watering hole.

• Attackers profile their targets and identify the websites they visit regularly
• The compromised site silently delivers malware to every visitor matching the target profile
• Because these sites are familiar and trusted, victims rarely suspect anything is wrong

5. Zero-day exploit attacks

Zero-day attacks take advantage of security flaws that are unknown to the software vendor, which means no patch or fix exists at the time of the attack. Drive-by downloads that use zero-day exploits are especially dangerous because even fully updated systems can be vulnerable to them.

• Attackers discover or purchase unpatched vulnerabilities in browsers or plug-ins
• Exploit kits weaponize the flaw before developers can release a fix
• Victims have no defense available until the vulnerability is publicly disclosed and patched

1. Clickjacking

Clickjacking can support drive-by-style attacks by tricking users into clicking something different from what they see, such as authorizing a download or changing a permission. Attackers overlay invisible elements on legitimate-looking buttons or links, causing users to unknowingly authorize a malicious download or grant permissions to malware.

• Invisible iframes or overlays capture clicks meant for harmless content
• A single click can silently trigger a download or enable camera, microphone, or location access
• Even cautious users can fall victim, since the visible page appears completely normal

Major drive-by download incidents

Several large-scale attacks highlight how destructive drive-by download attacks can be:

2016 malicious ads on major news sites
In March 2016, attackers compromised ad networks on sites like The New York Times, BBC, and AOL. Just loading these pages exposed users to hidden scripts. Exploit kits, including Angler, scanned for browser vulnerabilities and silently installed ransomware—no clicks needed.

2016 Chrome on Fedora drive-by download attack
In November 2016, researcher Chris Evans revealed how Chrome's auto-download behavior and Fedora's unsandboxed “Tracker” tool enabled silent malware infections. Chrome downloaded files without asking, and Fedora's Tracker indexed them automatically. This let attackers execute malicious code without user action. Gstreamer, Fedora's preview tool, had security flaws that made the attack even easier.

SocGholish (FakeUpdates) malware campaign
SocGholish, also called “FakeUpdates,” spreads through infected websites. Users see fake update prompts for browsers or Flash Player. Clicking downloads malware silently. Once inside, it can deliver ransomware, steal data, or open backdoors for future attacks.

Attackers rely on external components, ad networks, and security weaknesses to spread their malware quickly, catching even well-secured organizations off guard.

How to prevent drive-by downloads

Preventing these attacks requires a layered security approach. Here's what helps:

1. Keep software updated—patch browsers, plug-ins, and operating systems
2. Use intrusion detection systems to monitor traffic for suspicious activity
3. Install ad blockers to reduce exposure to malicious advertising networks
4. Use sandboxing tools to isolate and analyze suspicious downloads
5. Limit third-party plugins in web pages and applications
6. Train users to recognize warning signs of compromised websites
7. Back up data regularly to recover quickly in case of malware installation
8. Implement endpoint protection solutions that offer real-time malware detection and threat intelligence to monitor and block malicious activities on devices

Strong security policies and real-time monitoring help reduce the risk of unintentional downloads.

How NordLayer helps prevent drive-by downloads

NordLayer offers advanced security tools to protect against drive-by download attacks through its threat protection solutions. The download protection feature scans downloaded files for malicious content and automatically removes malware-infected files. On top of that, web protection helps block harmful websites, while DNS filtering by category can prevent access to malicious or phishing domains before users reach them. NordLayer encrypts all traffic, too, which helps keep data safe whether employees work on-site or remotely.

Ready to protect your business from hidden threats? Try NordLayer today and take control of your network security.