An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

• A. Vishing
• B. Typosquatting
• C. Watering hole attack
• D. Phishing

Answer: (C)

A watering hole attack targets a specific group by compromising websites they are known to visit and injecting malicious code there. The attacker first identifies the sites the target audience frequents, then breaches one or more of those sites and inserts malicious content. When members of the group visit the compromised site, the code runs in their browser and delivers malware or directs them to exploit kits, often without any user interaction beyond a normal visit. This approach leverages trust in legitimate sites to reach a focused audience and can be highly effective for espionage or targeted campaigns. In contrast, phishing relies on tricking individuals with deceptive messages or pages to reveal credentials, typosquatting involves creating a counterfeit domain that closely resembles a legitimate site to steal data, and vishing uses social engineering over the phone. The distinctive element of a watering hole is the compromise of trusted websites to silently infect the target group during regular visits.

A watering hole attack targets a specific group by compromising websites they are known to visit and injecting malicious code there. The attacker first identifies the sites the target audience frequents, then breaches one or more of those sites and inserts malicious content. When members of the group visit the compromised site, the code runs in their browser and delivers malware or directs them to exploit kits, often without any user interaction beyond a normal visit. This approach leverages trust in legitimate sites to reach a focused audience and can be highly effective for espionage or targeted campaigns.

In contrast, phishing relies on tricking individuals with deceptive messages or pages to reveal credentials, typosquatting involves creating a counterfeit domain that closely resembles a legitimate site to steal data, and vishing uses social engineering over the phone. The distinctive element of a watering hole is the compromise of trusted websites to silently infect the target group during regular visits.