Cyberpediaby Brain
ENDEFR

Watering hole attack

A site you visit every week can be booby-trapped. How a watering hole attack works, what you can see, and the habits that protect you.

In 30 seconds

Where it happens
On a site visited by a specific community (government, industry sector, region), during normal browsing1.
What the attacker wants
To run code on the victim's computer, which often gives access to systems on the internal network1.
The reflex
Keep the browser and its extensions up to date, and refuse any "update" offered by a web page, whatever the site.
If it has already happened
Tell the IT or security team without delay, even if nothing abnormal is visible.

What it is

In a watering hole attack, the attacker does not contact the victim. They booby-trap a site the victim already visits: they slip malicious code into it, then wait for visitors to come on their own.

For an employee, the danger comes from this trust. The site is familiar, useful for work, and nothing shows that it has changed. This article describes the mechanism, what you can notice, and what limits the damage.

Straight answers

What is a watering hole attack?

The sources describe the case where the site used by the attacker is often visited by a community (government, industry sector, region). The aim is to compromise a user or a group of users through a shared interest. This targeted campaign is called "strategic web compromise" or "watering hole attack"1. It belongs to the broader family of "drive-by compromise": the victim visits a site during normal browsing1.

Do you have to click on something to get infected?

Not always. The browser is generally the target of the exploitation, and it often requires no further action once the page is open2. In other cases, the user has to help the process by enabling scripts, notifications or active components, or by ignoring warning dialog boxes1.

Can a well-known, trusted site really be booby-trapped?

Yes, that is the principle. The attacker compromises a legitimate site to inject malicious code into it1. They can also modify script files served to the site from an online storage space open for writing, or buy booby-trapped advertising from legitimate ad networks1.

Is an up-to-date browser enough?

No, but it reduces the risk. Updating all browsers and plugins can prevent the exploitation phase1. MITRE also notes that protections against exploitation depend on the architecture and the targeted software, and that sandbox escapes may exist1.

1Inside the attacker's head1 min

The attacker starts by choosing a place where the target spends time: a site visited by a sector, a field of activity or a region2. They then prepare the environment. The booby-trapped content can be hosted on infrastructure they have acquired or have already compromised2. They can also buy domains that look like legitimate domains (homoglyphs, deliberate typos, another extension)2.

They then slip code into the site: scripts in pages or in content that users can edit, such as forum posts2. They can also add scripts that examine the visitor's browser, to check that it is vulnerable before attempting the exploitation2. One group is described as embedding code in sites to check a visitor's IP address, then exploiting their browser only if they are of interest2.

This preparation takes place largely out of sight of the targeted organisation, which makes it hard to detect2. Legitimate web services also serve as relays: compromised WordPress sites have thus hosted malicious payloads to download3.

2What you see on screen1 min

The scripts run automatically1. The scripts generally look for the version of the browser and plugins, searching for a vulnerable version1. In some cases, a second visit is needed before the exploitation code arrives1.

A few visible signs exist all the same. A page may ask you to enable scripts or notifications, or push you to ignore a warning1. By clicking "allow" in browser notifications, a user can give a site permission to run JavaScript in their browser1. Some campaigns use fake browser updates as a lure: this is the case of SocGholish, spread by compromised sites whose content poses as a browser update1.

3Under the hoodIT teams1 min

Here is a neutralised illustration, with a fictitious address in .invalid. It does not work.

Excerpt
[Legitimate page of an industry site]
  ... usual site content ...
  [hidden element added by the attacker, zero size]
  [it loads a page from hxxps://exemple[.]invalid/ in the background]

The typical chain, according to MITRE ATT&CK, follows four steps. The user visits the site that hosts the attacker's content. Scripts run and look for browser and plugin versions. If a vulnerable version is found, the exploitation code is delivered. If the exploitation succeeds, the attacker gains code execution on the computer, unless other protections exist1.

The goal differs from an attack on a server exposed to the Internet: here, software on the workstation is exploited, which often gives access to systems on the internal network1. Browsers are a common target of client-side exploitation, as are widespread third-party applications in companies, for example Adobe Reader and Flash4.

On the defence side, the sources cite browser sandboxes, which reduce part of the impact (sandbox escapes may exist)1, ad and script blockers, and disabling browser notifications1. The UK NCSC adds that most modern browsers block known phishing and malware sites, but not always on mobile5. It also recommends using only supported and up-to-date software, and not browsing the web with an administrator account5.

4Case filesReal cases1 min

Forbes.com, 2014

APT19 carried out a watering hole attack on forbes.com in 2014 to compromise its targets1. The sources give no other detail on this episode.

Operation Dust Storm, exploitation of CVE-2014-0322

During Operation Dust Storm, the attackers used a watering hole attack against a popular software reseller. They were exploiting an Internet Explorer flaw not yet known to the public (zero-day), CVE-2014-03221. The source gives no campaign date.

Login page of an Israeli shipping company, until November 2021

In campaign C0010, the attackers compromised the login page of a legitimate Israeli shipping company and probably set up a watering hole that collected information on visitors2. This watering hole is described as active until at least November 20211.

Fact sheet

Identifier
CP-027
Wing
1. Attacks and techniques
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-046
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. MITRE ATT&CK, “Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1189/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Stage Capabilities: Drive-by Target, Sub-technique T1608.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1608/004/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Compromise Infrastructure: Web Services, Sub-technique T1584.006 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1584/006/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1203/ (accessed 3 November 2026)
  5. NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)

Cite this article

Brain, “Watering hole attack”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website/

BibTeX 
@misc{brain_cp027_en_2026,
  author = {Brain},
  title = {Watering hole attack},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/watering-hole-attack-compromised-website/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence