A watering hole attack involves an attacker targeting a specific group of users by compromising websites that the group is known to visit. The other options do not involve targeting users through websites they visit.