Can the service tell the click wasn't intentional?

No, and that's what makes the attack effective: the click comes from your browser, in your authenticated session. From the service's point of view, nothing distinguishes it from a deliberate action.

Is this still common today?

Browsers and major services apply protections that prevent frame display, which has greatly reduced the attack surface. The risk remains on services that don't declare these protections, and checking third-party permissions is still the right habit.

Clickjacking (hijacked click)

In plain terms

You click on what you see, but the click lands on something else: an invisible button laid over the page. The action really is yours, its target isn't.

Definition

Clickjacking consists of overlaying a visible page with a transparent element from another site, so that a click aimed at the displayed content is received by that hidden element instead.

How it works

A page can display another page in a frame, make it transparent, and position it under the cursor. The user sees an innocuous button — play a video, accept a banner — and clicks it; the click is received by the invisible frame, where a button from a service the user is already logged into sits. The result is an authenticated action they didn't intend: authorizing an application, approving a permission, publishing something. The particularity is that nothing is spoofed: the click is real, the session is real, and the service can't tell this action apart from a deliberate one. That's why the defense is almost entirely on the sites' side, which tell the browser to refuse being displayed in a frame — a protection now widely deployed, which makes the attack rarer than it used to be without making it disappear.

Warning signs

Button whose click produces a different result from what was announced
Overlapping banners or windows requiring several clicks in quick succession
Permission granted to an application you didn't install
Post, subscription, or permission appearing after a visit to an unfamiliar site
Page insisting you click at a precise spot to continue

How to verify

A hijacked click is noticed after the fact rather than during: review the third-party applications authorized and the permissions granted on your main accounts. A permission you don't recognize will be clearly visible there, whereas the click itself left no trace.

What to do

Keep your browser up to date, since it applies the protections sites declare. Be wary of pages that demand a sequence of closely spaced clicks at precise spots, and log out of sensitive services rather than staying permanently signed in — a hijacked click is only worth something on an open session.

If it already happened

Remove third-party application permissions you don't recognize, revoke active sessions, and check recent posts or permissions. Change the password if a sensitive action may have been carried out in your name.

Frequently asked questions

Can the service tell the click wasn't intentional?: No, and that's what makes the attack effective: the click comes from your browser, in your authenticated session. From the service's point of view, nothing distinguishes it from a deliberate action.
Is this still common today?: Browsers and major services apply protections that prevent frame display, which has greatly reduced the attack surface. The risk remains on services that don't declare these protections, and checking third-party permissions is still the right habit.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Website and browser attacks family. Last updated: 2026-09-02.