This is a technique born out of the need to gather information about targets that are rather enlightened about web threats and cannot fall for cheap tricks. Here, a social engineer will compromise the cod list of a legitimate website that a target frequently visits and then embed some malware in it. Good sites to do this are discussion forums, stock exchange tips sites, sports websites, and lifestyle websites. When the target visits the website, the malware will infect their device and from there start collecting data from the browser or from the computer's hard drive. Watering holes are successful because they are the last place that a target will think that they might get attacked.
However, resilient attackers will have studied ...
