[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1189":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1189","T1189","Drive-by Compromise",14,"MITRE","**What attackers do.** Attackers compromise or create websites so that simply visiting them, often through malicious adverts or a hijacked legitimate site, delivers exploit code or a malicious download to the visitor. This serves the Initial Access tactic.\n\n**How to defend.** Keep browsers and plugins patched automatically, use web filtering and ad blocking at the proxy or browser level, and enable browser isolation for higher risk users. Application control limits what downloaded files can do. Collect proxy logs and browser telemetry so visits can be tied to later endpoint events.\n\n**Signs to look for.** Look for browsers spawning unexpected processes, downloads that follow redirects through several domains, and fake update prompts on otherwise legitimate sites. A common gap is that the infected site is trusted, so reputation filtering does not catch it.","Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:\n\n* A legitimate website is compromised, allowing adversaries to inject malicious code\n* Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary\n* Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising)\n* Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting)\n\nBrowser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1189\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":25,"title":26,"published_at":27},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",{"slug":29,"title":30,"published_at":31},"zero-click-candiru-spyware-delivered-via-malicious-ads-hits-al-jazeera","Zero-Click Candiru Spyware Delivered via Malicious Ads Hits Al Jazeera","2026-10-15T18:20:37.304+00:00",{"slug":33,"title":34,"published_at":35},"mercenary-spyware-hijacks-ad-networks-to-silently-infect-devices","Mercenary Spyware Hijacks Ad Networks to Silently Infect Devices","2026-10-15T12:21:42.608+00:00",{"slug":37,"title":38,"published_at":39},"ai-accelerates-full-chain-chrome-exploit-development-to-just-six-days","AI Accelerates Full-Chain Chrome Exploit Development to Just Six Days","2026-10-14T12:20:21.412+00:00",{"slug":41,"title":42,"published_at":43},"zero-day-chain-exploited-by-chinese-hackers-to-deploy-cleangulp-malware","Zero-Day Chain Exploited by Chinese Hackers to Deploy CLEANGULP Malware","2026-09-23T10:22:36.112+00:00",{"slug":45,"title":46,"published_at":47},"zero-day-exploit-chain-targets-ngos-via-spear-phishing-and-compromised-university-site","Zero-Day Exploit Chain Targets NGOs via Spear-Phishing and Compromised University Site","2026-09-15T08:20:56.69+00:00",{"slug":49,"title":50,"published_at":51},"bluemoon-exploit-kit-chains-chrome-windows-zero-days-for-espionage","BlueMoon Exploit Kit Chains Chrome & Windows Zero-Days for Espionage","2026-09-12T12:20:26.148+00:00",{"slug":53,"title":54,"published_at":55},"sogou-input-method-flaw-exploited-to-deploy-grayrabbit-backdoor","Sogou Input Method Flaw Exploited to Deploy GRAYRABBIT Backdoor","2026-09-11T08:21:05.374+00:00",{"slug":57,"title":58,"published_at":59},"chrome-v8-zero-day-exploited-in-the-wild-patch-immediately-1788949273428","Chrome V8 Zero-Day Exploited in the Wild — Patch Immediately","2026-09-09T10:21:13.219+00:00",{"slug":61,"title":62,"published_at":63},"zero-day-in-anysign4pc-enables-silent-backdoor-installation-via-watering-hole-attacks","Zero-Day in AnySign4PC Enables Silent Backdoor Installation via Watering-Hole Attacks","2026-07-30T12:21:14.882+00:00",{"slug":65,"title":66,"published_at":67},"malvertising-campaign-assembles-malware-in-the-browser-to-evade-detection","Malvertising Campaign Assembles Malware in the Browser to Evade Detection","2026-07-25T22:20:20.422+00:00",[69,73,78,83,88,92],{"slug":70,"name":71,"problem":72,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76,"stories":77},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",8,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":84,"name":85,"problem":86,"stories":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":89,"name":90,"problem":91,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":93,"name":94,"problem":95,"stories":96},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",3,[98,104,109,113,118,124,128,134],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","2","Control 2","Inventory and Control of Software Assets",12,{"family":99,"item":105,"code":106,"title":107,"together":108},"9","Control 9","Email and Web Browser Protections",11,{"family":99,"item":110,"code":111,"title":112,"together":108},"7","Control 7","Continuous Vulnerability Management",{"family":99,"item":114,"code":115,"title":116,"together":117},"13","Control 13","Network Monitoring and Defense",10,{"family":119,"item":120,"code":121,"title":122,"together":123},"nist-800-53","si-3","SI-3","Malicious Code Protection",9,{"family":119,"item":125,"code":126,"title":127,"together":77},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":129,"item":130,"code":131,"title":132,"together":133},"gdpr","32","Article 32","Security of processing",7,{"family":135,"item":136,"code":137,"title":137,"together":133},"itil","overview","ITIL"]