A
drive-by download automatically downloads and executes malware when a user simply visits a compromised or malicious website — no user action (like clicking) required.
Exploits unpatched browsers and plugins (Flash, Java, PDF readers). Defense: keep browsers/plugins updated, web filtering, browser isolation, NoScript extension. Users don't need to click anything.