An exploit kit is a prepackaged set of tools, usually hosted on a web page, that checks a visitor's browser and plug-ins for known vulnerabilities and silently delivers malware to those it can exploit. It works only against unpatched software, so fast browser updates and removing unused plug-ins defeat most of it.
How does the attack unfold?
"Exploit kit" is an industry term rather than a formal standard category, so it helps to look at the technique it implements. MITRE ATT&CK describes this as Drive-by Compromise (T1189), an initial access technique where an adversary gains access through a user visiting a website in the course of normal browsing.
ATT&CK lists several ways to put hostile code in front of a visitor: compromising a legitimate website, tampering with script files served from a publicly writable cloud storage bucket, paying for malicious ads through legitimate ad providers, abusing user-controllable content in a web application, and abusing browser push notification permissions.
The typical process it describes runs in four steps:
- A user visits a site that hosts the adversary's content.
- Scripts run automatically, usually checking the versions of the browser and plug-ins.
- If a vulnerable version is found, exploit code is delivered.
- On success, the adversary gets code execution on the user's system unless other protections are in place.
ATT&CK adds that sometimes a second visit is needed before the exploit is delivered, and that targeted versions of this, aimed at a community that shares a website, are called watering hole attacks.
Why do these kits exist as products?
NIST's malware guide explains the economics. It observes that attackers can buy or download malware toolkits and customize their output, and that many have user-friendly interfaces that let unskilled attackers produce capable malware. It walks through one example: a toolkit sends spam to lure users to a site, the site infects computers with Trojan horses by exploiting operating system vulnerabilities, and the Trojans install tools such as keystroke loggers and rootkits.
NIST also notes that this web-based pattern, often called drive-by download, does not fit the classic virus or worm categories, because the infected website does not infect the host. It installs other tools onto it.
What makes a visitor vulnerable?
The kit needs a known flaw to exist on the visitor's machine. That means an outdated browser, an old plug-in, an operating system missing security updates, or a document viewer that has not been patched. Where browsers update automatically the window is short, but machines that rarely restart and locked-down corporate images that lag behind stay exposed longer.
A constructed example
A regional trade association's website is compromised through an outdated content management plug-in. An attacker adds a small script to every page. Members visit during their normal work. The script quietly checks the browser version. Most members have current browsers and nothing happens. A handful use a locked-down workstation image that updates quarterly, and one of them is two versions behind with a known flaw. That machine gets malware. Nobody clicked a download link. This scenario is invented, but it mirrors the watering hole pattern ATT&CK describes.
How to check or apply this
- Turn on automatic updates for browsers and operating systems, and enforce a restart deadline.
- Remove browser plug-ins and extensions nobody needs.
- Where you control the network, filter known-malicious domains and ads with a secure web gateway or DNS filtering.
- Keep your own website's CMS, plug-ins and third-party scripts patched, and review any script loaded from storage you do not control.
- Use site isolation and the browser's built-in sandbox settings in managed environments.
- Run endpoint protection that watches behavior, since signatures lag customized malware.
- Hunt for the signs: unexpected redirects, new script tags, and outbound requests to unfamiliar domains.
Quick check
Is an exploit kit the same as ransomware?
No. The kit is a delivery mechanism. What it delivers can be ransomware, a banking trojan or anything else.
Do I need to click anything to be infected?
In a drive-by, often not. Visiting the page may be enough if the browser has a known, unpatched flaw. ATT&CK notes that the user may be required to assist, for example by enabling scripting or ignoring a warning.
Sources
- MITRE ATT&CK T1189 Drive-by Compromise
- NIST SP 800-83 Revision 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
Last reviewed: 18 October 2026.
