# What is a drive-by download?

A drive-by download infects a computer when someone simply visits a web page: a compromised legitimate website, a malicious advertisement, or a page that pretends to be a browser update or a CAPTCHA and tricks the user into running something. CISA's advisory on the Interlock ransomware group, AA25-203A of 22 July 2025, describes drive-by downloads from compromised legitimate websites and the ClickFix technique, in which a fake prompt persuades the user to paste and run a command. Defences are current browsers and operating systems, DNS and web filtering, stopping users from running scripts they paste, and teaching people that a website never needs them to run a command. Once something runs, it usually calls home: NetSenX flags the resulting beaconing to a new outside server on every plan.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-a-drive-by-download

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is a botnet, and how would we know a device of ours is part of one?](https://netsenx.com/en/faq/what-is-a-botnet)
- [What is a remote-access trojan (RAT)?](https://netsenx.com/en/faq/what-is-a-remote-access-trojan)
- [What is an initial access broker?](https://netsenx.com/en/faq/what-is-an-initial-access-broker)
- [What is a web shell?](https://netsenx.com/en/faq/what-is-a-web-shell)
- [What is protocol tunnelling?](https://netsenx.com/en/faq/what-is-protocol-tunnelling)