Cybersecurity glossary
What is a Watering-Hole Attack?
Learn what a watering-hole attack is, how adversaries infect websites a target community already visits, how it differs from phishing and malvertising, and how to reduce third-party browse risk.
Definition
A watering-hole attack is a strategy in which adversaries compromise or inject hostile content into a website that a chosen community already trusts and visits—industry forums, vendor documentation, local news, or hobby sites—so targets are infected or phished during ordinary browsing rather than by a lure they must click in email.
Why attackers wait at sites you already bookmarked
Phishing has to invent a reason to visit. A watering-hole attack skips that step. Adversaries profile a community—defense contractors who read one news site, accountants who use one tax-prep forum, developers who live on one package registry’s docs—and then compromise that habitat. When the victim arrives, the origin in the address bar is familiar. That familiarity is the social-engineering payload.
The strategy is efficient against organizations with decent mail filters. It is also a way to hit people who never open unsolicited attachments: they still browse. For a patient intrusion set, one vulnerable industry CMS can be worth more than a month of spear-phishing copy.
The compromise may be the site itself, a plugin, a JavaScript CDN, or an ad slot. From the user’s point of view the distinction is invisible. They went where they always go.
How a watering-hole operation is staged
Profile the community’s habits
Identify sites, forums, update servers, and documentation that the chosen sector or company actually visits.
Pick a reachable habitat
Favor properties with weak CMS patching, forgotten plugins, loose JS supply chains, or sellable ad inventory.
Inject hostile content
Plant a script, iframe, fake banner, or trojanized download that runs in the trusted origin’s context.
Optional: filter the victims
Some campaigns check IP, language, or cookie clues so only the intended organizations receive the payload.
Deliver the payload
Trigger a drive-by exploit, credential page, or expected installer that now contains extra code.
Collect and persist
Beacon out, steal sessions, or stage implants while the user believes they are still on a known-good site.
What “poisoning the habitat” can look like
CMS and plugin takeover
An outdated WordPress plugin or forgotten staging host lets attackers edit templates that every visitor loads.
Third-party script infection
A analytics, chat, or CDN file included by many industry sites becomes a single watering hole for all of them.
Trusted download swap
The community’s usual ISO, browser extension, or printer driver is replaced with a signed-looking trojan.
Selective serving
The malicious branch appears only to visitors from target ASNs, so casual users and the site owner see a clean page.
Watering hole versus nearby web threats
| Threat | Who chooses the site | Trust trick |
|---|---|---|
| Watering-hole attack | The victim, from habit | A bookmark or industry site is already trusted |
| Phishing | The attacker, via a lure | The message impersonates a brand or colleague |
| Malvertising | The victim, but the ad network chooses the creative | Ads on otherwise legitimate pages |
| Drive-by download | Either; this is the delivery mechanic | The browser does the dangerous work with little extra consent |
Reducing the blast radius of trusted browsing
- Patch browsers and plugins aggressively; watering holes often pair a trusted site with a known client-side exploit.
- Use content security policy, subresource integrity, and strict script allowlists on sites you operate so you are harder to turn into someone else’s watering hole.
- For high-risk roles, prefer browser isolation or a dedicated research browser that is not logged into corporate SSO.
- Monitor enterprise DNS and HTTP logs for rare script hosts appearing under industry domains your staff visit daily.
- Inventory third-party JavaScript on your own properties; a poisoned vendor tag makes you the watering hole.
- Prefer official package registries and hashed downloads over ‘the forum said to get it here.’
- Subscribe to sector threat intel that names strategic web compromises; bookmarks are not a threat-intel feed.
- Treat unexpected login prompts on documentation and news sites as hostile; those origins should not be asking for your IdP password.
If you run a community site, you are part of other people’s threat model
Industry associations, OSS docs, and regional newsrooms are high-value watering-hole candidates because their visitors share an employer type. Hardening those properties—2FA on CMS accounts, plugin hygiene, SRI, and change monitoring on templates—is a public-good security control, not only a publisher concern.
The practical takeaway
A watering-hole attack relocates the lure from the inbox to a site the victim already chose. Trust in the destination is pre-loaded; the attacker only has to occupy it.
Defend both sides: make your own sites difficult to poison, and assume that even familiar industry URLs can serve a hostile script. Patch the browser, isolate high-risk research, and watch third-party JavaScript as if it were production code—because in a watering hole, it is.
Related security terms
Drive-By Download
The common payload on a poisoned site: malware delivered through the browser with little or no extra click.
Malvertising
Hostile ads can turn a still-uncompromised site into a watering hole by poisoning the ad slot instead of the CMS.
Phishing
Phishing brings the victim to the attacker; a watering hole waits where the victim already goes.
Cross-Site Scripting (XSS)
Stored XSS is one way a trusted origin starts serving attacker JavaScript to every visitor.
Social Engineering
The social element is habitat selection: attackers study what a community already trusts, then occupy it.
Frequently asked questions
What is a watering-hole attack in simple terms?
Attackers poison a website that a specific group already uses—like an industry blog or a supplier portal—so those people get malware or a fake login while doing normal work, without a phishing email.
Why is it called a watering hole?
The metaphor is predators waiting at a water source. The ‘water’ is a site the herd already visits. The attacker does not chase each target; they wait where the targets gather.
How is this different from phishing?
Phishing sends a lure that the victim must open. A watering hole uses a destination the victim chose. Email filters and ‘don’t click unknown links’ advice do not apply to a bookmark they have used for years.
Do watering holes always exploit the browser?
Often they do, via drive-by downloads or exploit kits. Others inject a fake login, a malicious update, or a trojanized software download the community expects from that site.
Who gets targeted?
Communities with shared browsing habits: a sector’s news site, a regional chamber of commerce, an open-source project page, or a vendor’s documentation used by one company’s engineers.
Can a CDN or plugin compromise become a watering hole?
Yes. If many target organizations load the same third-party script, compromising that script poisons every site that includes it—sometimes without hacking the site owners at all.
How do defenders detect this?
Look for unexpected script hosts on known-good sites, new outbound callbacks from browsers after visiting industry domains, and threat intel about strategic web compromises in your sector.
References
Explore authoritative guidance and frameworks related to watering-hole attack.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.