Post

Honey, wake up - #clickjacking is back. A decade ago, #clickjacking was the hot new #attack—tricking users into clicking invisible #frames layered over legit websites, unknowingly performing actions on their social media, corporate accounts, or even banks. 1/3

paulosyibelo.comBlog: DoubleClickjacking: A New Era of UI Redressingdata:blog.metaDescription

Tal Skverer

@taltechtreks.com

Over time, defenses evolved: #CSRF protections, X-Frame-Options to prevent framing, and SameSite: Lax cookies to block cross-site authentication made clickjacking obsolete. But guess what? It’s back — #DoubleClickjacking bypasses these defenses #exploiting how #browsers handle mouse events. 2/3

4/2/25, 10:13 pm0 reposts1 like

Tal Skverer

@taltechtreks.com

4 Feb 2025

Using the technique on a newly opened window, the first click closes it, underneath is an #authorization button that the second click presses, approving access for a #malicious app. Pretty clever—and hopefully, defenses catch up before this trick gets widely abused. 3/3