What attackers do. Attackers compromise or create websites so that simply visiting them, often through malicious adverts or a hijacked legitimate site, delivers exploit code or a malicious download to the visitor. This serves the Initial Access tactic.
How to defend. Keep browsers and plugins patched automatically, use web filtering and ad blocking at the proxy or browser level, and enable browser isolation for higher risk users. Application control limits what downloaded files can do. Collect proxy logs and browser telemetry so visits can be tied to later endpoint events.
Signs to look for. Look for browsers spawning unexpected processes, downloads that follow redirects through several domains, and fake update prompts on otherwise legitimate sites. A common gap is that the infected site is trusted, so reputation filtering does not catch it.