Compromised infrastructure is legitimate hardware, software, or hosting that attackers take over after unauthorized access. Instead of building every malicious service on a dedicated server, criminals reuse real websites, cloud accounts, email systems, or endpoints as part of their own operation. The victim system still looks ordinary from the outside, which helps the attacker blend in and keep activity running.
This matters because a compromised system can do more than host malware. It may deliver malicious files, relay commands, store stolen data, or track infected machines. Using many abused systems spreads risk and makes takedown harder: removing one node does not stop the rest. Defenders look for unexpected file changes, new admin accounts, strange outbound traffic, and unapproved services. In practice, compromised infrastructure turns a routine breach into a broader attack platform, which is why patching, access control, log review, and rapid containment are essential.