In August 2025, security researchers at Guardio Labs built a fake medical-results page with an ordinary CAPTCHA checkbox. Hidden behind it, in text no human could see, sat instructions written for an AI. When Perplexity’s Comet browser landed on the page, it followed them. It clicked an invisible button and started a file download, with no one at the keyboard to approve anything.
That test file was harmless. A real attacker’s wouldn’t be. Guardio’s point was simple: the drive-by download, one of the web’s oldest tricks, has found a new victim that never hesitates.
Drive-by downloads infect a device through a website visit. Sometimes there’s a tricked click, and sometimes nothing at all happens on the user’s end. For years, they were powered by exploit kits, ready-made toolsets that probe a visitor’s browser for unpatched holes. The method has shifted since, but the goal hasn’t. Here’s how these attacks work, which ones shaped the playbook, and what changes when AI agents start browsing on your behalf.
What a Drive-By Download Actually Is
A drive-by download is malware that arrives through a web page you visited, without you knowingly choosing to install it. The page may belong to a criminal, but more often it’s a legitimate site that’s been compromised or is serving a poisoned ad.
These attacks come in two broad flavors.
Zero-click attacks need no action from you. Malicious JavaScript or HTML on the page scans your browser, plugins, and operating system for known weaknesses. If it finds one, it slips the payload in silently. You may never notice anything happened.
Tricked-click attacks need you to do one small thing. The page fakes a problem, like a missing font, an outdated plugin, or a “verify you’re human” box, and the fix it offers is the malware. Attackers often copy the look of trusted software so the download feels routine.
Once inside, the payload can steal data, hijack traffic, enlist the device in a botnet, or lock it up entirely. Internet of Things gadgets with old firmware are frequent targets, since they rarely get patched.
Four Attacks That Shaped the Playbook
| Campaign | When | How it got in | What it taught defenders |
| Nuclear exploit kit | Mid-2010s | Scanned for browser and plugin flaws, then silently dropped trojans and ransomware | Unpatched plugins were the soft underbelly of the web |
| Rig exploit kit | Mid-to-late 2010s | Malvertising: booby-trapped ads bought on reputable sites | A trusted site can still serve an untrusted ad |
| EITest “HoeflerText” | 2017 | Garbled compromised pages for Chrome users, then offered a fake “Chrome Font Pack” that delivered Spora ransomware | A convincing fake error beats a technical exploit |
| Flashback | 2011–2012 | First posed as an Adobe Flash installer, then exploited a Java flaw on compromised sites | Macs aren’t immune; it infected over 600,000 of them |
Flashback deserves a footnote. Oracle fixed the Java bug it used in February 2012, but Apple maintained its own Java build back then and didn’t ship the patch until April 3. The gap between a fix existing and a fix arriving was all the attackers needed. That pattern still drives most drive-by infections today.
How Attackers Deliver Them Now
Malvertising remains a favorite. Criminals buy ad space on reputable sites, or compromise an ad network, and serve ads that redirect visitors or probe their browsers. Some malicious ads don’t even need a click to start scanning.
Cross-site scripting (XSS) exploits sites that accept user input without cleaning it. An attacker plants a script in, say, a comment field, and the site then serves that script to every visitor.
Watering hole attacks compromise sites a specific group trusts and visits often, like an industry forum or a supplier portal. Familiarity lowers everyone’s guard, even careful users’.
Phishing links push victims toward the malicious page through email, social media or chat apps. Exploit kit code travels this way too.
ClickFix is the tricked-click attack of the moment. A fake CAPTCHA tells you to press a few keys, which quietly pastes and runs a malicious command, so you end up installing the malware yourself. Microsoft’s 2025 Digital Defense Report ranked ClickFix as the top initial-access method in its Defender Experts notifications, at 47% compared with phishing’s 35%. ESET measured a 517% jump in these campaigns between late 2024 and the first half of 2025.
The AI Twist: When the Browser Clicks for You
ClickFix depends on a human doing something odd. Guardio’s research asked what happens when the human isn’t the one browsing.
Its proof of concept, called PromptFix, adapted ClickFix for AI. The fake CAPTCHA looked normal to people, while CSS-hidden text told the AI agent the page had an “AI-friendly” verification button. Comet believed it, clicked, and kicked off a download. Guardio told The Hacker News the same trick also worked on ChatGPT’s Agent Mode.
The other tests went no better. Asked to check an inbox, Comet treated a phishing email posing as Wells Fargo as a genuine to-do item, clicked through, and filled in login details on the fake page. On an AI-generated fake Walmart store, it sometimes completed a purchase without asking. Google Safe Browsing was active in Comet’s Chromium base, yet it blocked none of the test sites.
Here’s why that matters for drive-by downloads specifically. Much of the web’s defense against them quietly assumes a human will hesitate. Think of Chrome’s “this file isn’t downloaded often” warning, the uneasy feeling a fake font prompt gives you, or a pause before pasting a strange command. An agent built to finish tasks fast has none of that instinct. Understanding what makes an agent different from a chatbot makes the risk clear: chatbots answer, while agents click, type, and download.
If you use an AI browser, keep it away from unfamiliar sites. Turn on confirmation prompts before any download or payment, and don’t hand it your inbox unsupervised.
What the Payload Wants
Attackers pick a payload to match the goal, whether that’s ad fraud, theft, or extortion.
| Payload | What it does |
| Adware | Floods the device with pop-ups and banners; some ads probe for further flaws |
| Botnet agent | Quietly enlists the device into a network used for distributed denial-of-service (DDoS) attacks |
| Keylogger | Records keystrokes to capture passwords and banking details |
| Trojan | Poses as useful software, then opens a back door for attackers |
| Ransomware | Encrypts files or locks the device until a ransom is paid |
Browser hijackers deserve their own mention. Browser hijackers change your browser settings without permission and steer your searches toward sites the attacker profits from. Some also carry spyware or ransomware.
The data they’re after is predictable. It includes personal details like names, addresses and Social Security numbers, plus card and bank account numbers. Login credentials sit high on the list, along with company files such as plans, research and internal messages. Even browser data like cookies and history has value, since stolen session cookies can let an attacker skip your password entirely.
Defenses for Site Owners
If you run a website, you’re the one keeping visitors safe. Patch your CMS, plugins and extensions promptly, and delete any you no longer use, since abandoned software is a favorite entry point. Vet your ad partners and review the ads they serve. Cut third-party scripts down to the ones you truly need, because every outside script is code you don’t control.
A web application firewall (WAF) helps filter malicious traffic and common injection attempts. Lock down admin accounts with long, unique passwords from a password manager, plus multi-factor authentication. Serve the site over HTTPS too. It won’t stop malware hosted on a hacked site, but it does stop attackers from tampering with your pages in transit.
Defenses for Everyday Users
Keep your operating system, browser and apps updated. Flashback showed how fast attackers move once a patch exists and users haven’t installed it. Download software only from official sources, since lookalike installers are a staple of these attacks. Uninstall programs you don’t use, because each one is another thing to patch.
Run reputable antivirus, and consider an ad blocker to cut exposure to malvertising. Stick with a mainstream browser like Chrome, Edge or Firefox, all of which include built-in protection against known malicious sites and downloads. And here’s one rule that defeats ClickFix outright: no real CAPTCHA will ever ask you to open a Run box or terminal and paste a command.
Can AI Fight Back?
Defenders are using AI too. In May 2025, Google began using Gemini Nano, a small language model running on your own device, inside Chrome’s Enhanced Protection mode to spot tech support scams in real time. Google says the model helps catch scam pages it hasn’t seen before, and it runs locally.
Machine learning helps endpoint tools catch malware that rewrites itself to dodge signature scans. Some of the same techniques also show up in how generative AI is used in cybersecurity on the attacking side, as criminals generate convincing lure pages at scale.
Leaning entirely on automated protection has its own pitfalls. Detection models throw false alarms that teach people to ignore warnings, and attackers deliberately craft inputs to slip past them. Teams can also grow complacent once “the AI is watching.” It helps to understand the potential risks and drawbacks of AI in cybersecurity before trusting any tool completely. Pair AI-powered protection with the dull basics: patching, official downloads, and a healthy pause before clicking.
That pause is exactly what AI agents lack. Whoever builds a browsing agent that pauses at the right moment, and only then, may end up closing the drive-by download’s newest door.
