Initiating an attack against targeted business and organizations, threat actors compromise a carefully selected website by inserting an exploit resulting in malware infection. The attackers run exploi

A Heartbeat attack (associated with Heartbleed, CVE-2014-0160) exploits the TLS heartbeat extension to leak server memory - it is a protocol-level vulnerability exploit, not a site-compromise infection technique.

Spear phishing is a targeted email-based attack that lures specific individuals into interacting with malicious content; it does not involve compromising third-party websites to passively infect visitors.

Shellshock (CVE-2014-6271) is a specific bash shell vulnerability allowing remote code execution via crafted environment variables - it is a vulnerability class, not an attack pattern matching this scenario.

A watering hole attack is named after the predator tactic of waiting at a water source - attackers identify and compromise legitimate, trusted websites known to be visited by their intended targets. The attack often incorporates zero-day exploits to maximize effectiveness against unpatched systems, which directly matches the scenario described. This distinguishes it from direct-targeting techniques like phishing because the victim is infected passively by visiting a site they already trust.