ExamWizardzExamWizardz
Start free
Security

What is watering hole attack?

A watering hole attack compromises a legitimate website that a target group visits often, then uses it to infect or phish those visitors.

What is a watering hole attack?

A watering hole attack compromises a website that members of a target group already visit, then waits for them to arrive. The name comes from predators that wait at a watering hole instead of chasing their prey. Rather than persuading a victim to click a link, the attacker goes where the victims already go: an industry association, a supplier portal, a trade publication, a software forum, a regional government site or a local business near the target's office. People do not hesitate on a site they have used for years, which is why the attack works.

How a watering hole attack works

  1. The attacker identifies sites that the target group trusts and visits regularly.
  2. The attacker compromises one of them, often through an unpatched content management system, a weak administrator password or a hijacked third-party script the site loads.
  3. Malicious code is added to the site. It may try to exploit a browser flaw, prompt a fake browser update download or redirect visitors to a credential-harvesting page.
  4. Careful attackers filter victims, serving the malicious code only to visitors from the target's IP address ranges, so the site behaves normally for everyone else and the compromise stays hidden longer.

A real watering hole case

In a campaign disclosed in early 2017, the website of Poland's financial regulator had been compromised and used to deliver malware to visiting banks. The attack code carried a list of target organizations' network ranges, so it singled out the intended victims. It shows the typical pattern: a trusted, low-suspicion site, a specific industry audience and selective delivery.

Indicators and defenses

Indicators include several users from the same department or industry infected after visiting the same legitimate site, endpoint alerts that trace back to a trusted domain, a familiar site suddenly loading scripts from an unfamiliar domain, and update prompts on sites that never showed them before.

Users usually have nothing to notice, so defenses are technical:

  • Keep browsers, plugins and operating systems patched to remove the flaws the site tries to exploit.
  • Run EDR on endpoints to catch unusual child processes and downloads from the browser.
  • Use DNS and web filtering that blocks newly registered and low-reputation domains.
  • Consider browser isolation for high-risk roles, so web content runs away from the endpoint.
  • Give users standard accounts, so a browser exploit gains little.

Site owners reduce the risk by patching their CMS, restricting admin access and controlling which third-party scripts their pages load.

Watering hole vs. phishing vs. supply chain attack

Phishing sends the link to the victim; a watering hole waits for the victim to come. A supply chain attack compromises a product, update or service the victim buys and installs, while a watering hole compromises a website the victim browses. Typosquatting relies on a mistyped domain the attacker registers, while a watering hole uses the real, legitimate site.

Watering hole attack on the CompTIA Security+ exam

Watering holes are listed among the human-based threat vectors in SY0-801 objective 2.3, the paths attackers use to reach a target. Scenario wording that points to one describes infections across a group that shares an interest or industry, all traced to one legitimate site they visited. Distractors include supply chain attack, spear phishing and typosquatting. For defense, expect patching, EDR, web filtering and browser isolation rather than user training alone.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

advanced persistent threat

An advanced persistent threat (APT) is a skilled, well-funded attacker, often state-backed, that quietly breaks into a network and stays for months.

EDR

EDR (endpoint detection and response) is security software on endpoints that records activity, detects threats by behavior and lets admins contain them.

spear phishing

Spear phishing is a phishing attack aimed at a specific person or small group, built from research about the target so the message looks routine.

supply chain attack

A supply chain attack compromises a trusted supplier, product or service, such as a software update or managed service provider, to reach its customers.

threat vector

A threat vector, also called an attack vector, is the path or method an attacker uses to reach a target, such as email, an open port or a USB drive.

typosquatting

Typosquatting is registering a look-alike domain or package name, such as examp1e.com, to exploit typing and reading mistakes for phishing or malware.

← Back to the full CompTIA glossary