A watering hole attack is when hackers booby-trap websites that a specific group visits a lot (staff pages, industry forums, local news). When someone from the target group opens the site, hidden code tries to infect their device or steal logins. Instead of chasing people one by one, attackers poison the “water” and wait.
You can get hit just by visiting a site you normally trust. If the malware lands, it can steal passwords, spy on activity, or spread inside a company or school network.
Pick the pond: attackers study what sites a team or community uses.
Compromise the site: break in via a weak plugin, password, or ad slot.
Plant traps: add malicious scripts or ads that target certain browsers/devices.
Infect/steal: visitors get redirected, prompted to install something, or silently exploited.
Trusted site suddenly asks to install a “codec/extension” or run an update.
Browser warnings about unsafe scripts or downloads you didn’t request.
Redirects: you load Site A and briefly bounce through unknown domains.
Multiple people in the same group report odd pop-ups or new toolbars.
Keep your browser, extensions, and OS updated; enable automatic updates.
Use real-time protection in your security software and block risky scripts where possible.
Don’t install extensions or “updates” prompted by random sites; get them from the official store.
If something felt off after visiting a usual site: disconnect from the network, run a full scan, change important passwords from a clean device, and tell your IT/support contact.