A watering hole attack alters a website that the intended victims already trust, so a normal visit can expose their devices.
The lure is familiarity, not a message sent directly to the victim, and this page does not explain how a site is broken into.
How it works
Typical targets are a trade publication, a supplier portal, or a local news page that a specific group reads.
Visitors arrive on their own because the site was already part of their work.
Defenders watch for sudden changes on those trusted pages and for unusual downloads afterward.
Limiting what browsers will run, and noticing a familiar site that suddenly looks different, matters more than curiosity about the break in.
Concrete examples
- An industry association page starts offering a software download it never offered before.
- A supplier portal changes a script and visitors begin to see new browser warnings.
- A local news site used by one office starts loading an unexpected external file.
Protective measures
- Limit what browsers may run or install from files they did not expect.
- Watch high value teams for unusual software after they use niche sites.
- Keep an inventory of third party scripts your own sites load.
- Encourage staff to report a familiar site that suddenly behaves differently.