Watering hole attack
Compromise a website your target visits regularly — instead of attacking the target directly. Like the lion waiting at the watering hole.
Famous case: the VOHO campaign (2012) compromised industry and government sites to attack Defense, energy, and research employees. The Forbes site in 2014 was used against the finance sector. iOS Safari attacks on Uyghurs through compromised religious sites (Google Project Zero, 2019). Defences: aggressive patching, browser isolation (Cloudflare Browser Isolation etc.), Lockdown Mode on iOS, segregating "browse" traffic from sensitive systems.