Post

Honey, wake up - #clickjacking is back. A decade ago, #clickjacking was the hot new #attack—tricking users into clicking invisible #frames layered over legit websites, unknowingly performing actions on their social media, corporate accounts, or even banks. 1/3

Over time, defenses evolved: #CSRF protections, X-Frame-Options to prevent framing, and SameSite: Lax cookies to block cross-site authentication made clickjacking obsolete. But guess what? It’s back — #DoubleClickjacking bypasses these defenses #exploiting how #browsers handle mouse events. 2/3