“The key thing about why these attacks are so dangerous and can lead to such high success rates is that they take out that important step of the target having to do something or be tricked. They might hack a democracy activist website knowing that all these potential targets are going to visit,' says Google TAG director Shane Huntley. “Let’s say attackers are going after democracy activists. And even once discovered, it's often unclear exactly how long an attack has been going on and how many victims there are. Watering hole attacks can be difficult to detect because they often operate quietly on legitimate websites whose owners may not notice anything amiss. Relatedly, it also evokes a predator that lurks near a watering hole waiting for prey to stop by. The name comes from the idea of poisoning a central water source that then infects anyone who drinks from it. The internet security firm ESET says it detects multiple watering hole attacks per year, and Google's Threat Analysis Group (TAG) similarly sees as many as one per month. But threat intelligence researchers emphasize that the technique is fairly common, likely because it's so powerful and productive. The most infamous watering hole attack in recent memory came to light in 2019, after targeting iPhone users within China's Uyghur Muslim community for two years. They're called watering hole attacks, and in addition to being a longstanding threat they've been behind several high-profile incidents lately.

But one particularly sinister technique starts with simply visiting a real website. Most hacks start with a victim making some sort of mistake, whether that's entering a password on a convincing-looking phishing page or accidentally downloading a malicious attachment on a work computer.

Costco lacey photo lab number