Clickjacking

Clickjacking is a malicious technique for tricking a user into clicking on something other than what the user believes they are clicking, typically by layering an invisible or disguised clickable element over legitimate-looking content. A victim who believes they are pressing a visible button, such as a video's play control, can instead unknowingly trigger a hidden action, like a purchase, because the click is captured by the concealed element beneath it. Because the victim is usually already logged into the targeted service, the resulting action carries the victim's own authentication, making the attack hard to trace back to its perpetrator. The technique was named by researchers Jeremiah Grossman and Robert Hansen in 2008 and has since developed into variants targeting browsers, mobile apps and other platforms.