What is a drive-by download and how can you protect yourself?

A drive-by download is a cyberattack that automatically installs malware on your device without your knowledge, often striking when you visit a compromised website or view a malicious ad.

In some cases, you don't even need to be exposed to a dangerous page or pop-up, making sophisticated drive-by downloads especially difficult to detect. For instance, researchers recently uncovered a campaign that used a tool called DarkSword to target iPhones through web browsers, demonstrating how attackers can steal sensitive data in seconds.

Read on to find out more about how drive-by attacks work, and discover ways to protect your devices.

How do drive-by downloads work?

Drive-by downloads usually occur when a malicious or compromised website attempts to install malware on your device. Some advanced attacks even exploit vulnerabilities in your browser, operating system, or software to install malware with little or no user interaction.

A typical drive-by download attack works like this:

1. You visit a compromised website: This could be a hacked legitimate website, or one created specifically to distribute malware.
2. The website checks your device: Hidden scripts identify details about your browser, operating system, and installed software to determine whether you're vulnerable to known security flaws.
3. A vulnerability is exploited: If your device is missing a security update or contains an exploitable flaw, the attacker attempts to execute malicious code without your knowledge.
4. Malware is installed: Once the exploit succeeds, malware is downloaded or executed on your device. Depending on the attack, this could be spyware, ransomware, remote access Trojans, or other malicious software.
5. The attacker gains access: The malware begins carrying out its intended purpose, such as stealing passwords, monitoring your activity, encrypting files, or creating a backdoor for future attacks.

Modern browsers, operating systems, and security software have helped make true drive-by downloads less common than they once were. However, they remain a major threat, particularly on devices running outdated software or browsers that haven't received the latest security patches.

For extra protection, consider using security software like Norton 360 that helps identify and shut down threats before they reach your device. The Norton Safe Web feature runs silently within the app, scanning websites in real time as you browse and warning you about suspicious or malicious sites before you visit them.

Why drive-by downloads are dangerous

Drive-by downloads and other forms of zero-click attacks are particularly dangerous because they can infect a device with malware without the victim knowingly downloading or installing anything. By exploiting security vulnerabilities, attackers may be able to compromise a device before the user realizes anything is wrong.

Once installed, malware can steal passwords and financial information, monitor your online activity, encrypt your files, or give attackers remote access to your device. In some cases, a single infection can lead to identity theft, financial fraud, or further attacks against your accounts or network.

The consequences can be severe. According to the FBI’s 2024 Internet Crime Report, cybercrime losses exceeded $16 billion in 2024. While only a fraction of these losses are likely to have stemmed from drive-by downloads, malware infections in general remain a common way for cybercriminals to steal sensitive information and carry out fraud.

Types of malware hidden in drive-by downloads

Hackers can use drive-by download attacks to install a wide range of malware, depending on the attacker's goals. Common examples include:

• Trojans: Disguised as legitimate software, Trojans can give attackers remote access to your device.
• Ransomware: Designed to encrypt your files or lock your device, ransomware then demands payment in exchange for restoring access.
• Keyloggers: By tracking and recording every keystroke you make on your device, keyloggers can capture sensitive information such as passwords or banking details.
• Botnets: After enlisting your device into a network of compromised devices, botnets will use your hijacked device to conduct cyberattacks.
• Data transfer tools: These applications allow hackers to transfer sensitive files from your device to their own systems.
• Spyware: By secretly monitoring your activity, spyware collects personal information without your consent.
• Adware: A kind of malware that delivers unwanted advertisements, adware can also track your browsing habits and often slows down your device.

While these malware types differ in how they operate and what they typically target, any of them can expose personal or financial information, increasing your risk of identity theft, fraud, and other forms of cybercrime.

How to prevent drive-by downloads

Preventing drive-by downloads starts with adopting safe browsing habits and keeping your devices secure. By following a few key practices, you can reduce the risk of malware installing on your system.

• Keep operating systems updated: Regular updates patch security vulnerabilities that hackers could exploit to deliver malware. Norton 360 includes a software updater to keep programs up to date and reduce security vulnerabilities.
• Only download legitimate software: Download apps and programs from trusted sources and official websites to avoid bundled malware.
• Beware of pop-ups: Avoid clicking on unexpected pop-ups or ads, as they can deliver drive-by downloads.
• Remove unused programs and apps: Unused software can pose a security risk if it’s not updated or maintained. Norton Utilities Ultimate helps you identify unused apps to free up space and reduce security risks.
• Beware of suspicious websites and links: Avoid visiting unknown or untrusted websites and never click links from unverified sources.
• Use an ad blocker: Ad blockers can prevent malicious ads from loading and triggering drive-by downloads.
• Install antivirus software: Antivirus programs like Norton 360 scan for threats in real time, blocking malware before it can infect your device.

Here’s a more in-depth look at the specific threats associated with drive-by downloads, and how to help protect against them with the help of Norton 360:

Signs you've been infected with a drive-by-download malware

No matter how stealthy the drive-by download itself, the resulting infection often reveals itself through unusual changes in your device's performance or behavior.

Watch out for these warning signs:

• Slower performance: Your computer suddenly slows down, freezes, or crashes more often.
• Unexpected pop-ups: Ads or pop-ups appear frequently, even on trusted websites or when you're not actively browsing.
• Unfamiliar programs: Apps, browser extensions, or software you don't remember installing appear on your device.
• Browser changes: Your homepage, default search engine, or browser settings change without your permission.
• Suspicious redirects: Clicking legitimate links sends you to unfamiliar or spammy websites.
• Disabled security software: Your antivirus or firewall is turned off or stops working unexpectedly.
• Unusual account activity: You notice unexpected logins, password reset emails, or messages you didn't send.
• Higher data usage: Your internet usage spikes for no obvious reason.

If you notice one or more of these signs, run a full security scan immediately and investigate the cause before continuing to use the device.

What to do if you've been infected with a drive-by-download malware

If you suspect your device has been infected, act quickly to limit the damage and prevent further compromise.

• Disconnect from the internet: Turn off Wi-Fi or unplug your Ethernet cable to stop the malware from communicating with attackers.
• Run a full antivirus scan: Use trusted security software, such as Norton 360, to detect and remove malicious files.
• Update your software: Install the latest updates for your operating system, browser, and apps to close known security vulnerabilities.
• Remove suspicious software: Uninstall unfamiliar programs, browser extensions, or apps you didn't intentionally install.
• Change your passwords: Update passwords for sensitive accounts, including email, banking, and shopping services.
• Enable multi-factor authentication (MFA): Use MFA to add an extra layer of protection to your important accounts wherever possible.
• Monitor your accounts: Watch for unusual account activity, unauthorized transactions, or security alerts that could indicate the attacker still has access.

Protect yourself from drive-by-downloads with Norton

By the time you figure out you’ve been exposed to a drive-by download, it’s too late. That’s where Norton 360 comes in, giving you peace of mind thanks to multiple layers of protection against drive-by downloads and other online threats.

Real-time security helps detect and block suspicious files and activity, while Safe Web warns you about potentially dangerous sites before you visit them. Get it today to protect your device, safeguard your personal information, and browse with greater confidence using comprehensive security built for everyday life.

FAQs

Can drive-by downloads happen on a Mac?

Yes, Macs aren't immune to drive-by downloads. A compromised website can exploit browser or software vulnerabilities to install malware or spyware, sometimes without requiring any interaction. Keeping macOS, your browser, and apps up to date — and using reputable security software like Norton 360 — can help protect your Mac from these threats.

Does Chrome stop drive-by downloads?

Chrome includes security features such as Safe Browsing that help block known malicious websites and downloads, but no browser can stop every drive-by download. Previously unencountered or sophisticated attacks may still bypass built-in protections, which is why it's important to keep your browser updated and use dedicated security software.

Are mobile devices or laptops more susceptible to drive-by downloads?

Both can be targeted, but laptops are generally at greater risk because they run a more diverse and complex range of software and are more likely to have exploitable vulnerabilities. Mobile devices can still be affected, particularly if you visit compromised websites, use outdated software, or download apps from untrusted sources.

Can malware install itself?

Yes, some forms of malware can install automatically without any user interaction. Drive-by downloads exploit security vulnerabilities to install malicious software when you visit a compromised website or, in some cases, simply view a malicious ad. Because these attacks can occur silently, you may not realize your device has been compromised until symptoms appear.