Drive-By Compromise

A compromise that occurs when a user visits a malicious or compromised website and code executes without the victim deliberately running a file. In identity-heavy environments, the important question is not just infection, but whether the browser’s session state or tokens can be abused after execution.

Expanded Definition

Drive-by compromise is a browser-mediated intrusion path in which simply visiting a malicious or compromised site triggers execution, often through a vulnerable browser, plugin, or embedded script. In NHI-heavy environments, the security question extends beyond initial code execution to whether the browser’s authenticated context, session cookies, or bearer tokens can be silently reused.

Definitions vary across vendors on whether the term should include malicious ads, compromised content delivery chains, or only exploit-based execution, but the common thread is that user intent to run software is absent. The term overlaps with exploit kits and watering hole attacks, yet it is distinct because the compromise happens through normal web access rather than through a downloaded file or deliberate launch. NIST’s Zero Trust Architecture guidance is relevant here because a browser session should never be treated as inherently trustworthy after page load.

The most common misapplication is assuming that a successful browser exploit is only an endpoint issue, which occurs when defenders ignore token theft, session fixation, and identity replay after the page is closed.

Examples and Use Cases

Implementing drive-by compromise detection rigorously often introduces more browser hardening, content filtering, and session controls, requiring organisations to weigh user convenience against reduced attack surface.

• A finance analyst visits a compromised news site and a hidden script steals a live SSO session, turning a web visit into identity abuse.
• A developer browses a vendor portal that has been injected with malicious JavaScript, and an API token cached in the browser is harvested for later use.
• A phishing campaign redirects users to a watering-hole page that exploits an unpatched browser component, then uses the session to access internal SaaS tools.
• A remote worker opens a public documentation site that has been poisoned through third-party content, and the attacker pivots from browser context into cloud console access.

NHIMG’s 52 NHI Breaches Analysis shows how often identity materials, not just malware, become the real objective. That is consistent with CISA Secure Our World recommendations to reduce exposure from unsafe browsing and credential handling. For a broader identity context, the Ultimate Guide to NHIs explains why credential reuse and overexposed identity material magnify a single browser incident.

Why It Matters in NHI Security

Drive-by compromise matters in NHI security because browser compromise can become the first step in stealing secrets, hijacking service portals, or impersonating automation that a human user did not intend to authorize. Once a session token, API key, or delegated OAuth grant is exposed, the attacker may operate as a trusted identity even after malware removal. This is why browser security, secret hygiene, and session scoping have to be treated as one control surface rather than separate problems.

NHIMG research shows the scale of the identity exposure problem: 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, which makes any browser-based token theft materially dangerous. The same pattern appears in NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now, where excessive privilege and poor visibility amplify the blast radius of a single compromise. External reporting on AI-orchestrated cyber espionage also reinforces the point that attackers increasingly automate post-exploit identity abuse.

Organisations typically encounter the full impact only after a browser incident is followed by unauthorized SaaS access, at which point drive-by compromise becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How do I respond to a confirmed NHI credential compromise?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• What did Shai Hulud 2.0 actually compromise?
• How do attackers turn stolen npm secrets into broader compromise?