A click on a legitimate button.
A fraudulent action confirmed.
Clickjacking exploits a page that looks safe. An invisible iframe hijacks a click into a malicious action, with no warning and no visible proof.
Visible page
Download the report
Subscription to confirm
4,99 €/mois
An internal page that looks safe
The user sees a legitimate button on their intranet. They're not suspicious.
An interface people trust
HR dashboards, payment forms, resource access: these pages are visible and familiar. One invisible overlay is enough to trick a click.
Key figures
A05
OWASP Top 10 · 2021
Security Misconfiguration
0
click required
to trigger the attack
0
visible warning
for the user
< 0s
to hijack the transaction
via a malicious iframe
Technical demo
Clickjacking simulator
This simulation shows how a legitimate action can be hijacked by an invisible iframe, then blocked thanks to browser protections.
Interactive demonstration
Clickjacking — click hijacking
A transparent iframe overlays a legitimate button. The user's click activates a hidden action — here a paid subscription at €4.99/month — without them knowing.
How hackers steal your credentials — 5 lesser-known techniques in 2026
Phishing now accounts for only half of account theft. Methods are evolving: infostealers, credential stuffing, adversary-in-the-middle…
Attackers now use ready-made kits available for under €20 on specialized forums. These tools automatically generate login pages identical to Microsoft's, Google's, or your bank's…
This article is reserved for Premium subscribers
Free access for 7 days, no commitment
Attack architecture
Legitimate page
banque-pro.fr
Transparent iframe
opacity: 0 — z-index: 9
User click
Target: the iframe, not the page
How to test it
- Click "Read the full article →"
- Enable "Reveal the iframe" to see the overlaid layer
- Enable "Protection ON" to see how X-Frame-Options blocks the attack
Documented real-world examples
- ·Premium subscriptions activated via "Close ad" buttons (a documented practice)
- ·Clicking "I agree" on invisible overlaid terms of service
- ·Camera/mic activation via fake video play buttons
- ·Bank transfers via corporate portals (2016 SWIFT fraud: $81M)
Invisible by design
The malicious iframe is positioned with opacity: 0 and a high z-index. The user only sees the page underneath, never the real target of their click.
Instant action
A single click is enough. The attacker doesn't need your password — your authenticated session confirms the action on your behalf. No further confirmation.
Countermeasures
X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none' prevent any iframe embedding. On the UX side: 2FA confirmation for sensitive actions.