An exploit kit is a packaged toolkit, usually hosted on a web server, that checks a visitor's browser and plug-ins for known weaknesses and silently delivers a matching exploit to install malware. It turns known, unpatched flaws into a service attackers can rent or reuse, and it depends on victims running outdated software.
How is an exploit kit different from an exploit?
An exploit takes advantage of a bug. MITRE ATT&CK defines it as code that exploits a bug or vulnerability to cause unintended behavior in hardware or software. An exploit kit is the delivery system around many such exploits. It selects the right one for each visitor so the attacker does not have to.
Think of the exploit as the key and the kit as the locksmith who carries a ring of them and tries each on the lock.
How does the typical chain work?
MITRE catalogues the entry point as Drive-by Compromise, technique T1189: an adversary gains access through a user visiting a website in the normal course of browsing. It lists ways to deliver exploit code to a browser, including a compromised legitimate site, tampered script files served from a writable cloud storage bucket, and malicious ads served through legitimate ad providers, also known as malvertising.
A constructed walk-through shows the stages:
- A person opens a news page that loads an advertisement from a third-party network.
- The ad redirects, through one or two hops, to a landing page the kit controls.
- The landing page profiles the browser: its version, plug-ins and operating system.
- If the profile matches a flaw the kit knows, it sends the exploit.
- A successful exploit runs a small loader that fetches the final payload, such as ransomware or a credential stealer.
- If nothing matches, the visitor sees nothing unusual.
The person clicked nothing suspicious. That is why the technique has been so effective.
What are real examples?
ATT&CK's drive-by page mentions groups that distributed malware through named kits. For instance, the entry for the RTM group says it distributed its malware via the RIG and Sundown exploit kits, as well as through an online advertising network. Those names appear in public reporting from the years when browser plug-in flaws were plentiful.
The mix changed. Browsers update themselves, and plug-ins that supplied many exploitable bugs have largely been retired. Kits still exist, but they need fresh browser or operating system flaws, which are scarcer and costlier. That is a gain from defenders' work, not a reason to stop.
What do defenders do about them?
The kit's core assumption is that a flaw is still open on the victim's machine. Take away that assumption:
- Keep browsers, operating systems and extensions on automatic updates, and track the age of the oldest unpatched device.
- Remove plug-ins and extensions that nobody needs.
- Use web filtering and DNS filtering to block known malicious domains and ad redirects.
- Run endpoint protection that can spot post-exploitation behavior.
- Limit what a logged-in user can do, so a compromised browser session reaches less.
- Use the CISA Known Exploited Vulnerabilities catalog to prioritize which browser and operating system bugs to patch first.
Site owners have a part too. Compromised sites and tampered third-party scripts are how kits reach visitors, so inventory the scripts you load and control who can change them.
How to check or apply this
- Audit device patch levels weekly and chase the oldest.
- Turn on automatic browser updates across the fleet.
- Remove unused browser extensions with a managed policy.
- Enable DNS or web filtering with a block list that updates itself.
- Review the third-party scripts on your own public pages and require integrity checks where possible.
- Practice the response: if a drive-by infection is suspected, isolate the device and review what it could reach.
Where does Safeguard fit?
For website owners, Safeguard scans application dependencies, including front-end packages, so a vulnerable or compromised library does not sit unnoticed in the code you serve to visitors. It does not detect exploit kit traffic on a network.
Quick check
Do exploit kits need the user to click anything?
Usually no beyond visiting a page. The exploit runs when the browser loads content, which is why it is called a drive-by.
Are exploit kits still a threat?
They persist, though they are less common than in the plug-in era. They still depend on unpatched software, so fast updates remain the main defense.
Sources
- MITRE ATT&CK T1189, Drive-by Compromise
- MITRE ATT&CK T1587.004, Develop Capabilities: Exploits
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
