Malware delivery methods

Malware reaches browsers through a few repeatable methods. Some need your click, like fake updates. Others need only a visit, like exploit kits.

The table maps each method to its first defense. Each row links to a full playbook.

Updated 2026-10-30

How does malware reach the browser?

Malware delivery methods and first defenses. Sources: MITRE T1189, MITRE T1583.008, MITRE T1204.004, MITRE T1176.001, and CISA.
Method	How it reaches you	First defense	Playbook
Drive-by downloads	A hacked or malicious page pushes a file or runs exploit code	Keep the browser patched. Never open files you did not request.	Malicious downloads
Malicious ads	Paid ads, often in search results, copy real brands	Type the vendor's address instead of clicking ads	Malvertising
Fake browser updates	A page claims your browser is outdated and offers an installer	Update only from the browser's own About page	Fake browser updates
Paste-and-run (ClickFix)	A fake error or CAPTCHA copies a command for you to run	Never paste website commands into Run or Terminal	Clipboard hijacking
Malicious extensions	An extension with broad access reads pages and steals data	Remove extensions you do not use	Malicious browser extensions
Exploit kits and watering holes	A hacked site probes your browser for known flaws	Patch promptly and relaunch	Exploit kits
Browser zero-days	A page exploits a flaw before you have the fix	Relaunch as soon as an update waits	Browser zero-day exploits
Ransomware footholds	A downloaded file installs a loader for later attacks	Keep offline, tested backups	Ransomware from browser downloads

Malware delivery methods and first defenses. Sources: MITRE T1189, MITRE T1583.008, MITRE T1204.004, MITRE T1176.001, and CISA.

A malicious extension abuses its browser permissions. It can read pages, steal sessions, or redirect searches.

A browser zero-day exploit targets an unknown or unpatched vulnerability in a browser or its components to execute code or escape the sandbox.

An exploit kit probes your browser for unpatched flaws. A match lets it install malware without a prompt.

Fake browser updates are deceptive popups or pages that claim your browser is outdated and push a malicious “update” download.

A malicious download looks useful but carries malware. Common lures are fake updates, invoices, and cracked software.

Malvertising uses paid ads to deliver malware or scams. The ads often copy trusted brands.

Ransomware can start with a malicious file from the web. The file gives attackers a first foothold.