Clickjacking

Clickjacking tricks you into clicking something hidden under a harmless-looking button or page, so you approve an action you never meant to.

Clickjacking: Clickjacking hides a real button or permission prompt under something that looks harmless. You think you are tapping Play or Close, but your tap lands on the hidden control, such as Allow, Like, Install or Confirm payment. It abuses trust in what you see on screen.

On websites it may be a hidden frame holding a social media page behind a video play button. On phones, a malicious app can show a transparent layer over a permission dialog so that your tap enables something dangerous. Fake close buttons on ads and pop-ups are a milder form and lead to unwanted pages or downloads. Some fake pages also place a transparent button over a normal one to approve a payment or follow request.

Defences include updating your browser and phone, avoiding sites with aggressive pop-ups, and being careful with apps that can draw over other apps. If a screen behaves oddly or a prompt appears suddenly, do not tap through. Close the page or app using the system buttons and check what changed. Slow down for a moment when a prompt appears right after you tap something unrelated.

Tips

• Close odd pages with the browser's tab switcher, not the close button inside the page.
• Switch off the display-over-other-apps right for apps you do not trust.
• Avoid sites full of pop-ups, fake prize screens and forced notification prompts.

Related terms