During which step of the cyber-attack lifecycle is a user's web browser redirected to a webpage that automatically downloads malware to the endpoint?

Question

Options

• Adelivery
• Bweaponization
• Creconnaissance
• Dcommand-and-control

• A
  95% (18)
• C
  5% (1)

Explanation

Delivery is correct because this phase is when the attacker transmits the malicious payload to the target - a drive-by download via browser redirect is a classic delivery mechanism, moving the weapon from the attacker's infrastructure onto the victim's endpoint.

Weaponization (B) is wrong because that step occurs before delivery - it's when the attacker creates or packages the malware exploit, not when it reaches the victim. Reconnaissance (C) is wrong because that's the earliest phase, focused purely on gathering information about the target (no malware is deployed yet). Command-and-Control (D) is wrong because C2 happens after delivery and installation - the malware must already be running on the endpoint before it can "phone home" to the attacker.

Memory tip: Think of the Kill Chain in chronological order - Recon → Weaponize → Deliver → Exploit → Install → C2 → Act. The browser redirect scenario involves the payload arriving at the victim, so it sits squarely in the middle "hand-off" step: delivery.

No community discussion yet for this question.