What is a watering hole attack?

The attacker does not go after the victim directly: they compromise a website the victim visits often — an industry portal, a supplier, a trade association — and wait. When the victim arrives, they receive malicious code from a site they trust. The name comes from the predator that waits at the watering hole.

Why it is so effective

It bypasses user suspicion, because the visit is voluntary and the site is the usual one. It also tends to target an entire sector, which makes it a typical tool for advanced groups interested in a specific industry, trade or region. Content filtering often fails to block it too: the domain has a good reputation.

How to reduce the risk

Keep browsers and plugins patched to close the vulnerabilities being exploited, apply browser isolation for risky browsing, restrict third-party script execution, and monitor endpoint behavior instead of relying only on malicious domain lists.