The Invisible Click Attack
Clickjacking and likejacking are UI-based attacks that trick users into clicking on something different from what they perceive, potentially leading to unwanted actions like liking pages, sharing content, or even making purchases without realizing it.
What is Clickjacking?
Clickjacking: A malicious technique where an attacker overlays transparent or opaque layers over a legitimate web page to hijack clicks meant for one action to perform another.
Likejacking: A specific type of clickjacking on social media where users unknowingly "like" or share content by clicking on what appears to be something else entirely.
The Scope of Deceptive Clicks
These attacks exploit the visual and interactive nature of social media to manipulate user actions invisibly.
How Clickjacking Works
1. Invisible Iframe Overlay
Technique: Transparent iframe positioned over legitimate buttons or links.
User sees: "Play Video" or "Download File" button.
User actually clicks: Hidden "Like" button, "Share" button, or malicious link underneath.
2. Cursor Jacking
Technique: Displaying a fake cursor while hiding the real one.
Impact: User thinks they're clicking one thing but are clicking elsewhere.
Common on: Gaming sites, video player simulators.
3. UI Redressing
Technique: Overlaying malicious elements over legitimate UI components.
Example: Fake "Close" button that actually shares spam.
Result: Users unwittingly perform actions they never intended.
Common Likejacking Scenarios on Social Media
- Video Players: Fake play buttons that trigger likes or shares
- Surveys/Quizzes: Claiming you must like a page to see results
- Shocking Content: Sensational headlines requiring likes to view
- Contests/Giveaways: Fraudulent promotions requiring likes to enter
- App Permissions: Fake permission dialogs that like pages
- Close Buttons: X buttons that don't close but trigger actions
- CAPTCHA Tricks: Fake verification that performs hidden actions
Consequences of Clickjacking
Potential Damages
- Unwanted endorsements - Your profile appears to support content you don't
- Spam propagation - Your like/share exposes your network to scams
- Malware distribution - Clicks can initiate downloads or installations
- Privacy breaches - Granting app permissions without knowledge
- Reputation damage - Liking offensive or inappropriate content
- Account compromise - OAuth approvals granting account access
- Financial fraud - One-click purchases or subscriptions
- Data harvesting - Apps gain access to your profile data
How to Detect Clickjacking Attempts
Red Flags
- Suspicious positioning: Buttons that seem oddly placed or misaligned
- Slow-loading content: Delays before allowing interaction
- Unexpected tabs/windows: New windows opening when clicked
- Forced likes: Content requiring likes to view
- Transparent layers: Visible overlays or visual glitches
- URL mismatches: Hovering shows different destination than displayed
- Aggressive pop-ups - Difficult-to-close windows
Protection Strategies
- Use browser extensions - NoScript, uBlock Origin can prevent clickjacking scripts
- Enable click-to-play plugins - Requires explicit permission for plugins to run
- Be suspicious of forced actions - Legitimate content doesn't require likes to view
- Hover before clicking - Check if link destination matches what's displayed
- Keep software updated - Browsers include clickjacking protections
- Review recent activity - Regularly check your likes, shares, and permissions
- Remove suspicious likes - Unlike pages you don't recognize
- Revoke app permissions - Audit and remove unfamiliar connected apps
- Use official apps - Avoid web-based interfaces when possible
- Report suspicious content - Help platforms remove clickjacking pages
- Educate yourself - Stay informed about new clickjacking techniques
- Trust your instincts - If it feels off, don't click
I've Been Likejacked - Now What?
Damage Control
- Unlike/unshare immediately - Remove the unwanted action from your profile
- Review activity log - Check for other unauthorized likes, shares, or posts
- Revoke app permissions - Remove any apps you didn't intentionally authorize
- Change password - If you suspect account compromise
- Enable 2FA - Add extra security layer
- Warn contacts - If spam was shared to your network
- Report the page/content - Help platform take down the clickjacking site
- Run antivirus scan - If you clicked downloads or suspicious links
- Review privacy settings - Ensure no changes were made without permission
Key Takeaways
- Clickjacking tricks users into clicking hidden or misrepresented elements
- 68% of users have accidentally liked content due to deceptive interfaces
- Legitimate content never requires you to like or share before viewing
- Browser extensions and updated software provide strong protection
- Regularly audit your likes, shares, and app permissions
- Reporting clickjacking helps protect the entire community
- If something requires a forced action to proceed, it's likely malicious