Watering-hole attack
A watering-hole attack targets people through a website their community is likely to visit, using compromised content to deliver malicious code or a deceptive request.
The attacker waits where the audience already goes
Instead of sending each person a lure, the attacker uses a site that reaches the intended audience. MITRE describes communities linked by an industry, region, or shared interest. A legitimate site’s compromised content can become the delivery point.
The site’s real address may be correct. That makes this different from a lookalike domain, where the visitor reaches a separate, deceptive address. Recognizing the domain does not rule out a website compromise.
A visit does not always lead to the same attack
Some campaigns exploit vulnerable browser software. Others persuade visitors to download and run something. Google Threat Intelligence Group documented APT24 injecting script into legitimate sites, checking visitors’ browser characteristics, and presenting selected visitors with fake download prompts.
That targeting also means two visitors may see different behavior. A colleague opening the site and seeing nothing unusual does not establish what appeared during an earlier visit.
Keep browsers and endpoint protections maintained, and treat unexpected installation or permission requests as new decisions even on a familiar site. A site visit alone does not prove that a payload ran.
The search-ad article explains how to distinguish browsing, downloading, and execution evidence in a different delivery route. If the unexpected request is to allow notifications, the browser-notification article explains what that permission actually grants.