Other meanings of Clickjacking
Cybersecurity
Clickjacking is a web security attack that tricks users into clicking hidden or disguised page elements, often leading to unintended actions such as authorizing payments, changing account settings, or sharing sensitive data. The technique relies on transparent or opaque layers over visible content, so victims believe they are interacting with a legitimate interface while actually triggering a different, often malicious, function. First documented in 2008 by security researchers Robert Hansen and Jeremiah Grossman, clickjacking has evolved into a family of related attacks, including likejacking, cursorjacking, and file-jacking, and remains a persistent threat despite modern browser defenses.
Clickjacking works by embedding a target page in an invisible iframe overlaid on a decoy page. The attacker uses CSS to set the iframe's opacity to zero and positions it precisely over a button or link the victim is lured to click. Because the browser treats the click as occurring on the iframe's content, the victim unknowingly performs an action on the target site, such as clicking a "Like" button or submitting a form.1
Several variants have emerged. Likejacking specifically targets social media buttons, while cursorjacking manipulates the visual cursor position to mislead users. File-jacking tricks users into granting file system access, and cookiejacking aims to steal session cookies. More advanced forms combine clickjacking with other attacks, such as cross-site scripting, to amplify impact.2
One of the earliest high-profile clickjacking attacks occurred in 2008 when a hacker exploited a vulnerability in Adobe Flash to enable a user's webcam and microphone without consent. This incident, dubbed "clickjacking," was demonstrated at the OWASP AppSec conference and prompted immediate industry attention.3
In 2009, a Facebook likejacking worm spread rapidly, tricking users into liking a page that then posted malicious links to their profiles. More recently, clickjacking has been used in cryptocurrency theft, where victims are tricked into confirming blockchain transactions. The attack's impact ranges from privacy breaches to financial loss, and it has been implicated in high-profile account takeovers.4
Modern browsers and web developers employ several layers of defense against clickjacking. The most common is the X-Frame-Options HTTP header, which instructs browsers to block framing of a page. The Content Security Policy (CSP) frame-ancestors directive provides a more flexible alternative, allowing developers to specify which domains may embed the page.5
Client-side defenses include frame-busting scripts, which attempt to detect and break out of iframes, though these can be bypassed. For critical actions, developers often implement user confirmation dialogs or require re-authentication. The OWASP Clickjacking Defense Cheat Sheet recommends a combination of server-side headers and client-side checks, along with using the SameSite cookie attribute to limit cross-site requests.6
Clickjacking has a surprising history in browser security research. The term was coined by Hansen and Grossman, but a similar concept called "UI redressing" was described earlier by researchers at Stanford University. In 2010, a researcher demonstrated a "cross-site search" attack that used clickjacking to extract information from a victim's search history.7
Another niche variant is "tapjacking," which targets mobile browsers and apps, where touch events can be intercepted. Additionally, clickjacking has been used in "cursoryjacking" attacks that manipulate the browser's cursor icon to mislead users. Even with modern defenses, clickjacking remains a vector for "login CSRF" attacks, where an attacker forces a victim to log into an attacker-controlled account, potentially leaking sensitive data.8
This article focuses on the web security attack known as clickjacking, not to be confused with the unrelated term 'clickjacking' in user interface design.
Help improve the encyclopedia. Reports go straight to the site manager.