A drive-by download attack occurs when malicious software is downloaded and sometimes installed without the user's knowledge or consent simply by visiting a compromised website. These attacks often exploit browser, plugin, or operating system vulnerabilities. Protection involves keeping software updated, using modern browsers with security features enabled, and implementing strong Content Security Policies.
A drive-by download delivers malware to a visitor's device with no click required beyond loading a page. The attacker either compromises a legitimate site or lures the victim to a malicious one, then serves content that quietly probes the browser, its plugins, and the operating system for known vulnerabilities. When a matching flaw is found, an exploit runs and fetches a payload, dropping malware such as a banking trojan or a ransomware loader. Some variants only need the page to render; others rely on a deceptive prompt disguised as a codec or software update. Because the exploit fires inside an otherwise trusted browsing session, the victim usually sees nothing unusual while the infection completes.
The attack scales cheaply. A single compromised ad network, CDN, or third-party script can expose every visitor to every site that loads it, turning ordinary browsing into mass infection. Victims need no security mistake beyond running an unpatched browser or plugin, so awareness training does little. Once the payload lands it can steal credentials, enroll the machine in a botnet, or encrypt files. For a website operator, unknowingly serving a drive-by, usually through a hijacked script or malvertising, damages reputation, can lead to browser and search-engine blocklisting, and may expose regulated data handled on the affected page.
The strongest defense is patching: current browsers, extensions, and operating systems close the vulnerabilities most kits target, and modern browser sandboxing contains code that does slip through. Site owners should also control what runs on their pages, since the common delivery route is a compromised or malicious third-party script rather than the site's own code. A strict Content Security Policy limits where scripts may load from, but not what an already-trusted script does. cside routes third-party scripts through a hybrid proxy and analyses the JavaScript payload, so a tag that suddenly tries to trigger an exploit or fetch a hidden download can be flagged and blocked in real time.
Often no. The classic form runs as soon as a vulnerable browser renders the malicious page, needing no download prompt or deliberate click. Some campaigns do add a fake update or codec button to raise their success rate, but the defining trait is that infection can occur from a page visit alone.
Patching removes most of the risk because kits rely on known, already-fixed vulnerabilities, but it is not absolute. Zero-day exploits, unpatched plugins, and social-engineering prompts can still succeed. Layering sandboxing, script controls, and cautious extension use on top of prompt updates gives the most reliable protection.
We answer client-side security questions every day. Bring yours.