A legitimate site that an attacker has altered or injected with malicious content, often without the owner’s knowledge. In identity terms, it is a trusted external surface whose apparent legitimacy lets the attacker deliver malware or harvest credentials with less resistance.
What Makes a Website “Compromised”?
A compromised website is still a real, legitimate site, but an attacker has altered its content, scripts, redirects, or embedded objects. The site’s normal trust signals make malicious delivery and credential capture more effective than on an obviously hostile domain.
How Compromise Changes the Site’s Security Posture
The key security change is not ownership, but trust abuse. A compromised site can serve malware, host injected phishing pages, or silently redirect visitors into attacker-controlled flows while preserving the appearance of legitimacy. That makes it especially useful for deception, drive-by delivery, and stealing secrets such as passwords, session tokens, or API keys.
Because the site remains outwardly familiar, defenders may underestimate it as an attack source. A user who believes they are on a trusted property is more likely to click, log in, or approve a prompt, which gives the attacker a stronger path to execution than a standalone lure would.
Common Ways Websites Become Compromised
Compromise usually follows one of a few patterns: stolen administrator credentials, vulnerable plugins or content-management extensions, server-side code execution, misconfigured infrastructure, or injected third-party scripts and tags. The attacker does not need to replace the whole site; small changes to forms, links, or client-side code can be enough to capture data or install payloads.
In many cases the compromise is partial and selective. Attackers may alter only checkout pages, login flows, or high-traffic landing pages so the abuse is harder to notice and easier to monetize. That is why integrity monitoring matters as much as perimeter blocking.
Why Compromised Websites Are Effective Attack Surfaces
A compromised site combines legitimacy, reach, and timing. Visitors often arrive through search, bookmarks, or known brand references, so the attack benefits from existing trust. If the site is also serving content over HTTPS, the browser may still show a secure connection even though the page content is malicious.
The attack value is often in the downstream effect: malware delivery, account takeover, credential harvesting, or secondary exploitation of downstream systems. The State of NHI & AI Agent Breach Report 2026 highlights how stolen credentials and compromised trusted surfaces frequently sit at the start of broader intrusion chains.
Risk and Threat Considerations
Compromised websites are dangerous because they blur the line between trusted and hostile content. Users, security tools, and even partner integrations may accept the site’s legitimacy while the attacker uses that trust to deliver malware, harvest secrets, or stage lateral movement.
Failure mechanism: The attacker exploits an already-trusted web property to inject malicious code, modify forms or redirects, and preserve enough normal behaviour to evade casual detection.
Impact: Organizations can see credential theft, session compromise, malware infection, brand damage, and fraud, with compromise persisting until integrity checks or incident response uncover the tampering.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1189 — Drive-by Compromise | Compromised sites are a classic drive-by delivery and browser exploitation vector. |
| T1566 — Phishing | Legitimate sites are often abused to host convincing credential-harvest pages. | |
| Recommendation — Hunt for drive-by activity and web-delivered payloads when trusted sites are modified. Treat site tampering that imitates login or payment flows as phishing infrastructure. | ||
| NIST SP 800-53 Rev 5 | SI-16 — Memory Protection | Web compromise often depends on code injection or tampering with executable content. |
| Recommendation — Apply content integrity and anti-tamper controls to detect unauthorized web modifications. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Compromised site detection depends on logging changes to pages, scripts and auth flows. |
| Recommendation — Log and review changes to sensitive web assets and authentication journeys. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Website compromise is often rooted in vulnerable web applications and extensions. |
| Recommendation — Reduce web compromise risk by hardening and updating internet-facing application software. | ||
Practitioner Guidance
What to watch for: Sudden page changes, unexpected scripts, altered login or checkout flows, new outbound domains, and file or template modifications are all signals that a legitimate site may have been tampered with. Security teams should treat web integrity as a live control problem, not just a hosting problem.
Practitioner takeaway: The most effective response is to assume the site’s reputation can be abused, then verify content integrity, admin access, and third-party script trust with the same discipline you would apply to a privileged system.
Related resources from NHI Mgmt Group
- What are the signs that a website or endpoint has been quietly compromised for malware delivery?
- Why do compromised website scripts and supply chain dependencies create such severe data breach risk?
- What happens when a supply chain partner's website is compromised and used to hold shipments hostage?
- What happens when a website loads a compromised script from a third-party provider?