What is a drive-by download?
A drive-by download infects a computer when someone simply visits a web page: a compromised legitimate website, a malicious advertisement, or a page that pretends to be a browser update or a CAPTCHA and tricks the user into running something. CISA's advisory on the Interlock ransomware group, AA25-203A of 22 July 2025, describes drive-by downloads from compromised legitimate websites and the ClickFix technique, in which a fake prompt persuades the user to paste and run a command. Defences are current browsers and operating systems, DNS and web filtering, stopping users from running scripts they paste, and teaching people that a website never needs them to run a command. Once something runs, it usually calls home: NetSenX flags the resulting beaconing to a new outside server on every plan.