Infrastructure compromise is the takeover or abuse of domains, subdomains, web hosts, or related online assets so they can be used for malicious activity. Instead of building every attack site from scratch, adversaries may hijack trusted infrastructure and turn it into a delivery channel for phishing, malware, redirects, or command-and-control traffic.
This matters because trust is part of the attack. A message or link hosted on a legitimate-looking domain is more likely to bypass reputation checks, confuse users, and delay detection. In practice, defenders may see unexpected DNS changes, new subdomains, altered web content, suspicious redirects, or authentication abuse on an otherwise normal property.
In defense, monitoring domain ownership, registrar settings, web content, certificates, and outbound traffic from trusted hosts can reveal compromise early. Infrastructure compromise is a classic trust-abuse technique: if the platform looks legitimate, the malicious activity hidden behind it can be much harder to spot.