# Drive-by Download

Malware that installs on a device automatically just from visiting a compromised website, with no user action required.

A **drive-by download[↗](/drive-by-download)** is an attack where malware[↗](/malware) installs on a visitor's device automatically, simply from loading a compromised or malicious webpage, without the user clicking anything or downloading a file on purpose. The attack typically exploits an unpatched vulnerability[↗](/vulnerability) in the browser, a plugin, or the operating system.

Because no obvious user action is required, drive-by downloads are especially dangerous: even a cautious person who never clicks suspicious links can be compromised by visiting an otherwise legitimate site that's been hacked to serve malicious code. Keeping browsers and plugins fully updated closes off most of the vulnerabilities this attack relies on.