A watering hole attack is a targeted cyberattack in which criminals compromise a legitimate website that a specific group is known to visit, so its visitors get infected without ever clicking a suspicious link. The name comes from nature. A predator saves energy by waiting at the watering hole, because sooner or later the herd has to drink. In 2016, the watering hole was a bank regulator. The website of Poland’s financial regulator, the KNF, had been booby-trapped to serve malware to Polish banks since at least early October 2016. For a Canadian SMB or nonprofit, the risk runs two ways. Your staff could be the prey, or your own website could be the watering hole.
What Is a Watering Hole Attack? The Predator Waits Where You Drink
A watering hole attack turns a website your team already trusts into a delivery route for malware. The attacker usually has no interest in the site owner. The site is simply the path to the people who visit it.
NIST describes it as attackers breaking into legitimate websites and planting malware to target and infect the people who visit them. CISA adds that this kind of targeted campaign often goes by another name, strategic web compromise. The two terms mean the same thing.
The label is older than many people assume. In July 2012, RSA described a campaign called VOHO and coined the term “water holing” to explain how it worked.
Watering Holes Get Past Filters Because There’s No Email to Catch
A watering hole attack skips the one thing most small-business defenses are built to stop, which is the suspicious email. Spear phishing needs a message, a lure and a click. A watering hole needs none of that. Your employee types a familiar address or opens a bookmark, and the trap is already waiting.
It still belongs to the family of social engineering attacks, because it exploits trust. The difference is that the trust is placed in a website, not a sender. Social engineering is common enough on its own. Verizon’s 2026 breach data ranked it the third most common breach pattern, at 16% of breaches.
The table below shows why a spam filter and an annual phishing quiz won’t cover this one.
| Spear phishing | Watering hole attack | |
|---|---|---|
| Starting point | A crafted email or message | A trusted website the target visits |
| What the victim does | Opens, clicks or replies | Visits a familiar site |
| What filters can inspect | Sender, links and attachments | Nothing until the page loads |
| Who gets hit | The people emailed | Visitors who match the attacker’s filter |
| Defense that matters most | Email filtering and training | Fast patching and browser hardening |
Each Attack Type Calls for a Different First Defense
Watering holes, whaling and password attacks can all end with someone inside your systems, but they start in different places. Whaling is spear phishing aimed at a senior executive. A typical example is a fake email from the CEO asking finance to send an urgent wire transfer.
A password attack goes after logins directly. One common example is credential stuffing, where criminals try usernames and passwords leaked in one breach on other services.
Here is how the three compare.
| Attack | Starts with | Typical example | First defense |
|---|---|---|---|
| Watering hole | A poisoned trusted website | Industry portal serving an exploit | Prompt patching |
| Whaling | A message aimed at an executive | Fake CEO wire transfer request | Call-back checks on payments |
| Password attack | Guessed or leaked logins | Credential stuffing | Multi-factor authentication |
Six Phases From Profiling to a Backdoor on Your Network
MITRE ATT&CK, the public catalog of attacker techniques, files watering holes under T1189, “Drive-by Compromise”. It sits in the Initial Access tactic and covers Windows, macOS, Linux and identity provider platforms. The phases line up with the cybersecurity kill chain, from reconnaissance through delivery and exploitation. In practice, the attack runs like this.
These phases map to MITRE ATT&CK technique T1189, so security tools and providers can reference the same steps when reporting detections.
- Profile the target. The attacker works out which sites a group visits, such as an industry association, a regulator, a supplier portal or a niche software vendor. Much of this comes from what your organization and staff share publicly online.
- Break into a trusted site. They pick the weakest site on the list, often one running an outdated content management system or plugin. The site owner becomes a victim too.
- Inject malicious code. A script, a hidden iframe or a full exploit kit goes onto the page. Visitors still see the normal site.
- Filter the visitors. The code checks each visitor’s IP range, browser and operating system. Only intended targets running vulnerable versions get the exploit. Everyone else sees nothing, which is why most visitors are never infected.
- Deliver a drive-by exploit. The exploit abuses a browser or operating system flaw so malware installs just from loading the page. When that fails, the page may ask the visitor to enable scripts or notifications, or to click past a warning.
- Dig in and spread. The malware opens a backdoor, steals data and may add the device to a botnet. From there, attackers move sideways using malware that spreads across networks toward file servers, finance systems or donor records.
Five Documented Watering Holes and the Lesson in Each
Attackers rarely poison famous brands. In the cases below, they picked regulators, ministries and specialist software sites with a small, valuable audience.
More than a decade separates the first and latest cases, and the Lazarus Group appears at both 2016 and 2024 to 2025.
VOHO (2012) Gave the Attack Its Name
RSA’s VOHO campaign mainly targeted political activists, the defense industry and education around Boston and Washington, DC. The lesson is that this tactic is well over a decade old, and it is still in use.
Poland’s Financial Regulator (2016) Infected Only Chosen Banks
The KNF site served malware selectively. Symantec found the exploit kit only infected visitors from about 150 IP addresses belonging to 104 organizations in 31 countries. Most of them were banks. Researchers linked the attacks to the Lazarus Group. The lesson is that a clean visit proves nothing. If you weren’t on the list, the site looked perfectly normal.
Project Zero’s iPhone Chains (2019) Hit Whoever Visited
Not every watering hole is picky. Google Project Zero found five iPhone exploit chains covering iOS 10 through iOS 12. They were used in indiscriminate watering hole attacks for at least two years before disclosure in August 2019. The chains relied on 14 vulnerabilities: 7 in the browser, 5 in the kernel and 2 sandbox escapes. Google estimated the hacked sites drew thousands of visitors per week. The lesson is that phones are endpoints too. “iPhones don’t get malware” is a myth worth retiring.
Mongolia’s Government Sites (2023 to 2024) Reused Spyware Exploits
From November 2023 to July 2024, Google’s Threat Analysis Group watched exploit campaigns on Mongolian government websites. The targets were iOS versions before 16.6.1 and Chrome on Android versions m121 to m123. The poisoned sites included the Ministry of Foreign Affairs and the cabinet website. The lesson is in the version numbers. The exploits only worked on older software, so a device updated on time was outside the target range.
Operation SyncHole (2024 to 2025) Went After Local Software
Between November 2024 and February 2025, Kaspersky found that Lazarus breached at least six South Korean organizations. They worked in software, IT, finance, semiconductor manufacturing and telecoms. During the investigation, Kaspersky also found a zero-day in Innorix software, since patched and tracked as KVE-2025-0014. The lesson is that the group behind the Polish bank attacks was still running the same playbook in 2024. And it aimed at software popular in one country, not a global brand.
What a Watering Hole Could Look Like for Your Business
Your biggest exposure is a small, trusted site in your own sector, or your own website. The three scenarios below are hypothetical illustrations, not real incidents.
The Association Site Your Staff Trust
Picture a provincial industry association that posts compliance templates for members. Its site runs a plugin nobody has updated since the volunteer webmaster left. Attackers inject a script that fires only for visitors from member organizations’ networks. Your bookkeeper downloads the new template, and an out-of-date browser does the rest.
The Supplier Portal Everyone Logs Into
Now picture a regional supplier’s ordering portal that your team uses every week. A poisoned login page pushes a fake “update your browser” prompt. The supplier is small and stretched, and nobody there notices for weeks. Every customer who clicks becomes an entry point.
Your Own Website as the Trap
Finally, picture your nonprofit’s WordPress site, where government program officers read your annual reports. An attacker filters for government IP ranges and serves an exploit only to them. Your site infects your funder, and you hear about it from them. That means cleanup costs, uncomfortable compliance questions and a strained funding relationship you worked years to build.
Funders often require grantees to report security incidents, so a compromised site can trigger obligations beyond technical cleanup.
Who Runs Watering Hole Attacks, and Why Naming Them Is Hard
The documented watering hole attacks trace mostly to advanced persistent threat (APT) groups, which are well-funded teams that dig in for the long haul. Russia’s APT29 and the Lazarus Group appear in three of the five cases above. Even so, researchers rarely name the culprit with full certainty.
Google linked the Mongolian campaign to APT29 with only moderate confidence. And SecurityWeek reported that the exploits were identical or strikingly similar to ones used by spyware vendors Intellexa and NSO Group. When the same code passes between commercial sellers and state teams, the code alone can’t name the attacker.
The setup muddies the trail further. The attack runs from someone else’s legitimate website, so the first fingerprints investigators find belong to an innocent site owner. A zero-day has no history to match against. For your business, attribution matters far less than closing the gap. You don’t need to know who’s at the door to lock it.
Defense Starts With Your Browsers and Ends With Your Own Website
Watering hole defense has two sides. You protect your people when they visit other sites, and you make sure your own site never becomes the trap. Warning signs are faint, so watch for small oddities. A familiar site suddenly asks you to enable notifications or scripts. A surprise browser update prompt appears. A download starts that nobody requested. A device starts calling out to unfamiliar addresses after normal browsing.
This is why patching outranks email training for this threat: the entry point is the software, not the inbox.
Patching carries most of the weight. Verizon’s 2026 breach report found that exploiting software vulnerabilities was the initial way in for 31% of breaches. In the same data, vulnerability exploitation overtook stolen credentials as the top entry point. Google’s threat intelligence team also saw browser zero-day exploitation fall to historical lows in 2025, while abuse of operating system flaws rose. Updating the browser alone isn’t enough.
If Your Staff Are the Visitors
Use this list to protect your data on every device your team browses from.
- Patch browsers and operating systems within days, on laptops and phones, because unpatched software is an open door for these exploits.
- Keep browser isolation features switched on. Chrome’s Site Isolation, for example, limits what an exploit can reach.
- Run endpoint protection on every device, including the ones staff use from home.
- Segment your network so one infected laptop can’t reach finance systems or donor databases.
- Monitor outbound traffic for connections to unfamiliar external sites.
- Train staff never to enable scripts or notifications on request, and never to click past a security warning, even on a familiar site.
If Your Website Could Be the Watering Hole
Your site is part of your risk management and compliance picture, not just your marketing. These steps reduce cyber risks for everyone who visits it.
- Patch your content management system, themes and plugins, and delete plugins you no longer use.
- Put a web application firewall (WAF) in front of the site.
- Monitor for injected scripts, new iframes and unexpected file changes.
- Require multi-factor authentication on every admin account.
- Keep an incident response plan that says who takes the site offline and who contacts your host and your national CERT for cleanup.
Quick Answers
What Is an Example of Whaling?
A fake email that appears to come from the CEO, asking the finance lead to wire money urgently, is a classic whaling attack. Whaling is spear phishing aimed at senior executives.
What Is an Example of a Password Attack?
Credential stuffing is a common one. Criminals take usernames and passwords leaked in one breach and try them on other services.
What Is Watering Hole Slang For?
In everyday speech, a watering hole is a place where a group regularly gathers, borrowed from the pools where animals drink. In cybersecurity, it means a website a target group visits often, which attackers poison to reach them.
Who Is Behind All the Cyber Attacks?
No single group is behind all cyberattacks. Documented watering hole campaigns point mostly to well-funded APT groups such as Russia’s APT29 and the Lazarus Group, though attribution is often uncertain.
Check Two Version Numbers This Week
Pick one day this week and check two things. Confirm that staff browsers and operating systems are on current versions. Then confirm that your website’s CMS and plugins are up to date. Those two checks close the kind of gaps most of the cases above relied on.
Not sure whether your organization looks more like the prey or the watering hole? Get your free cybersecurity score from RiskAware, or book a discovery call and we’ll walk through it with you.
