Cybersecurity glossary
What is a Drive-By Download?
Learn what a drive-by download is, how malicious sites and ads install malware with little user interaction, how exploit kits and fake buttons differ, and how to harden browsers against silent installs.
Definition
A drive-by download is malware delivery that occurs while a user is visiting a web page, with little or no intentional consent—either through a browser or plugin exploit that fetches a payload automatically, or through a deceptive one-click control that the visitor does not understand as an installer.
Why “I only visited a website” is still an incident class
Users think of malware as a file they chose. A drive-by download breaks that mental model. The visit is the delivery. Historically that meant an unpatched browser, Java applet, or Flash object fetching a payload as soon as the page rendered. Today it also means a page that needs only one confused click on a fake player, cloud-share, or “safe download” button.
The social-engineering overlay matters. Attackers learned that fully silent exploits are expensive against current Chrome, Edge, and Safari. Convincing someone that the next click is “play” or “view invoice” is cheaper. Both belong in this term because the victim did not intend to run an installer from that origin.
Drive-bys are the payload mechanic. Watering holes and malvertising are how people get to the mechanic without a phishing email.
How a drive-by chain executes
Land the browser on hostile content
A compromised site, malicious ad, XSS injection, or redirected short link serves the first stage.
Fingerprint the client
Script reads browser, OS, language, and sometimes domain-joined hints to choose an exploit or a lure.
Attempt automatic execution
An exploit kit targets a known bug so memory corruption leads to a downloader with no extra gesture.
Fall back to a deceptive click
If exploits fail, the page shows a fake codec, CAPTCHA, or document that is actually an executable or archive.
Fetch the payload
The binary arrives via a direct URL, a blob assembled in-page, or a nested iframe the user never notices.
Establish persistence
The malware requests elevation, abuses user-writable startup locations, or waits for the next reboot.
Two families of drive-by, one user story
Exploit-driven
Vulnerable browsers or plugins execute attacker code as the page loads. Patching and sandboxing are the main defenses.
Gesture-driven
The page needs a click, but the click is framed as play, print, or verify. The file that lands is the malware.
Smuggled files
JavaScript builds the download in the browser so secure web gateways that block `.exe` URLs see only HTML.
Hidden frames
Tiny iframes load exploit or redirect URLs under a page that looks static, including under ads.
Drive-by versus other web delivery
| Term | Role | User intent to install software |
|---|---|---|
| Drive-by download | Delivery mechanic in the browser | None, or a click they did not interpret as install |
| Malvertising | Ad-network path onto a legitimate page | Visit a publisher, not an installer |
| Watering-hole attack | Choice of which trusted site to poison | Browse a familiar community site |
| Phishing attachment | Mail-based delivery | Open a document from a message |
Hardening the client so a visit is not an install
- Enable automatic browser and OS updates; drive-by exploit kits are inventory against last month’s bugs.
- Remove leftover plugins and disable unnecessary protocol handlers that pages can invoke.
- Run users without local administrator rights so a downloaded payload cannot silently write system persistence.
- Use SmartScreen or equivalent reputation checks, knowing they are probabilistic, not a guarantee.
- Block unexpected executable and archive downloads at the secure web gateway, including files assembled as blobs where inspection allows.
- Apply application allowlisting on high-value endpoints so a new binary from the browser cache cannot run.
- Teach that in-page ‘update’, ‘codec’, and ‘view document’ buttons are installers until proven otherwise via a vendor’s own site.
- For research roles, isolate browsing from SSO sessions so a drive-by does not immediately inherit corporate cookies.
Incident hint: the user did not ‘download a file’
Help desks should ask where the person was browsing, not only which attachment they opened. Prefetch logs, browser download history, and unexpected *.exe or .js in the downloads folder after a news-site visit are classic drive-by residue—even when the user insists they did not install anything.
The practical takeaway
A drive-by download makes visiting the attack. Sometimes the browser is exploited. Sometimes a fake control converts one ordinary click into an installer. Watering holes and malvertising are how that visit is arranged.
Patch the client, drop unnecessary plugins, deny local admin by default, and treat in-page software offers as hostile. If malware can arrive without a conscious ‘save this installer’ decision, the browsing environment is part of the install base.
Related security terms
Malvertising
Hostile ads are a frequent vehicle that lands a visitor in a drive-by chain without the publisher’s page being hacked.
Watering-Hole Attack
A targeting strategy that plants drive-by content on sites a community already visits.
Cross-Site Scripting (XSS)
XSS can turn a trusted origin into the page that starts a drive-by by injecting attacker script.
Content Security Policy (CSP)
CSP and sandboxing reduce which scripts and plugins a page can use to fetch or execute a payload.
Social Engineering
Many modern drive-bys are not silent exploits; they are fake ‘download’ or ‘play video’ buttons the user is steered to press.
Frequently asked questions
What is a drive-by download in simple terms?
It is malware that arrives because you visited a page, not because you chose a file from a trusted vendor. The browser is exploited, or a fake button makes you install something you thought was a video or a document.
Do drive-by downloads still work without any click?
Silent exploits are rarer on fully patched modern browsers, but they still appear against outdated clients and plugins. Deceptive one-click installs remain common.
Is opening an email attachment a drive-by?
Usually no. Drive-by refers to web-origin delivery during browsing. Email attachments are a different delivery path, even if both end in malware.
How do exploit kits fit in?
An exploit kit is tooling that fingerprints the browser and tries known bugs so the payload downloads with no meaningful user gesture. Drive-by is the outcome; the kit is one implementation.
What is HTML smuggling?
A technique that builds the malicious file in the browser from script or blobs so network filters see HTML rather than a blocked executable. It often still needs a click, but it is used in drive-by style web delivery.
Does an ad blocker stop drive-bys?
It can prevent some malvertising-triggered chains. It does not help if the page itself is the watering hole or if the user clicks a fake download on a hostile site.
What is the fastest user defense?
Keep the browser and OS updated, avoid optional plugins, ignore in-page install prompts, and use a standard account without local admin rights so a downloaded payload cannot silently persist.
References
Explore authoritative guidance and frameworks related to drive-by download.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.