--- id: CP-027 slug: watering-hole-attack-compromised-website lang: en title: Watering hole attack description: A site you visit every week can be booby-trapped. How a watering hole attack works, what you can see, and the habits that protect you. canonical_url: https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website/ markdown_url: https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Watering hole attack", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website/ (CC BY 4.0) wing: 1 theme: outsmart_social_engineering reflex: cr-046 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website/ fr: https://startbrain.io/cyberpedia/fr/articles/watering-hole-point-d-eau-site-compromis/ de: https://startbrain.io/cyberpedia/de/articles/watering-hole-angriff-kompromittierte-website/ es: https://startbrain.io/cyberpedia/es/articles/ataque-abrevadero-sitio-web-comprometido/ sources: - "n": 1 title: Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1189/ accessed: "2026-11-03" - "n": 2 title: "Stage Capabilities: Drive-by Target, Sub-technique T1608.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1608/004/ accessed: "2026-11-03" - "n": 3 title: "Compromise Infrastructure: Web Services, Sub-technique T1584.006 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1584/006/ accessed: "2026-11-03" - "n": 4 title: Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1203/ accessed: "2026-11-03" - "n": 5 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" --- # Watering hole attack In a watering hole attack, the attacker does not contact the victim. They booby-trap a site the victim already visits: they slip malicious code into it, then wait for visitors to come on their own. For an employee, the danger comes from this trust. The site is familiar, useful for work, and nothing shows that it has changed. This article describes the mechanism, what you can notice, and what limits the damage. ## In 30 seconds - Where it happens: on a site visited by a specific community (government, industry sector, region), during normal browsing [1]. - What the attacker wants: to run code on the victim's computer, which often gives access to systems on the internal network [1]. - The reflex: keep the browser and its extensions up to date, and refuse any "update" offered by a web page, whatever the site. - If it has already happened: tell the IT or security team without delay, even if nothing abnormal is visible. ## Straight answers ### What is a watering hole attack? The sources describe the case where the site used by the attacker is often visited by a community (government, industry sector, region). The aim is to compromise a user or a group of users through a shared interest. This targeted campaign is called "strategic web compromise" or "watering hole attack" [1]. It belongs to the broader family of "drive-by compromise": the victim visits a site during normal browsing [1]. ### Do you have to click on something to get infected? Not always. The browser is generally the target of the exploitation, and it often requires no further action once the page is open [2]. In other cases, the user has to help the process by enabling scripts, notifications or active components, or by ignoring warning dialog boxes [1]. ### Can a well-known, trusted site really be booby-trapped? Yes, that is the principle. The attacker compromises a legitimate site to inject malicious code into it [1]. They can also modify script files served to the site from an online storage space open for writing, or buy booby-trapped advertising from legitimate ad networks [1]. ### Is an up-to-date browser enough? No, but it reduces the risk. Updating all browsers and plugins can prevent the exploitation phase [1]. MITRE also notes that protections against exploitation depend on the architecture and the targeted software, and that sandbox escapes may exist [1]. ## Inside the attacker's head The attacker starts by choosing a place where the target spends time: a site visited by a sector, a field of activity or a region [2]. They then prepare the environment. The booby-trapped content can be hosted on infrastructure they have acquired or have already compromised [2]. They can also buy domains that look like legitimate domains (homoglyphs, deliberate typos, another extension) [2]. They then slip code into the site: scripts in pages or in content that users can edit, such as forum posts [2]. They can also add scripts that examine the visitor's browser, to check that it is vulnerable before attempting the exploitation [2]. One group is described as embedding code in sites to check a visitor's IP address, then exploiting their browser only if they are of interest [2]. This preparation takes place largely out of sight of the targeted organisation, which makes it hard to detect [2]. Legitimate web services also serve as relays: compromised WordPress sites have thus hosted malicious payloads to download [3]. ## What you see on screen The scripts run automatically [1]. The scripts generally look for the version of the browser and plugins, searching for a vulnerable version [1]. In some cases, a second visit is needed before the exploitation code arrives [1]. A few visible signs exist all the same. A page may ask you to enable scripts or notifications, or push you to ignore a warning [1]. By clicking "allow" in browser notifications, a user can give a site permission to run JavaScript in their browser [1]. Some campaigns use fake browser updates as a lure: this is the case of SocGholish, spread by compromised sites whose content poses as a browser update [1]. ## Under the hood Here is a neutralised illustration, with a fictitious address in `.invalid`. It does not work. ```text [Legitimate page of an industry site] ... usual site content ... [hidden element added by the attacker, zero size] [it loads a page from hxxps://exemple[.]invalid/ in the background] ``` The typical chain, according to MITRE ATT&CK, follows four steps. The user visits the site that hosts the attacker's content. Scripts run and look for browser and plugin versions. If a vulnerable version is found, the exploitation code is delivered. If the exploitation succeeds, the attacker gains code execution on the computer, unless other protections exist [1]. The goal differs from an attack on a server exposed to the Internet: here, software on the workstation is exploited, which often gives access to systems on the internal network [1]. Browsers are a common target of client-side exploitation, as are widespread third-party applications in companies, for example Adobe Reader and Flash [4]. On the defence side, the sources cite browser sandboxes, which reduce part of the impact (sandbox escapes may exist) [1], ad and script blockers, and disabling browser notifications [1]. The UK NCSC adds that most modern browsers block known phishing and malware sites, but not always on mobile [5]. It also recommends using only supported and up-to-date software, and not browsing the web with an administrator account [5]. ## Case files ### Forbes.com, 2014 APT19 carried out a watering hole attack on forbes.com in 2014 to compromise its targets [1]. The sources give no other detail on this episode. ### Operation Dust Storm, exploitation of CVE-2014-0322 During Operation Dust Storm, the attackers used a watering hole attack against a popular software reseller. They were exploiting an Internet Explorer flaw not yet known to the public (zero-day), CVE-2014-0322 [1]. The source gives no campaign date. ### Login page of an Israeli shipping company, until November 2021 In campaign C0010, the attackers compromised the login page of a legitimate Israeli shipping company and probably set up a watering hole that collected information on visitors [2]. This watering hole is described as active until at least November 2021 [1]. ## Sources 1. MITRE ATT&CK, "Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1189/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Stage Capabilities: Drive-by Target, Sub-technique T1608.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1608/004/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Compromise Infrastructure: Web Services, Sub-technique T1584.006 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1584/006/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1203/ (accessed 3 November 2026) 5. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.