Click spoofing is a deceptive web attack that makes a user think they are clicking one thing while a different action is triggered. It usually relies on layered frames, overlays, or hidden controls to capture clicks and redirect them to a malicious function or permission change.
What Click Spoofing Is
Click spoofing is a user-interface deception attack in which the visible page misrepresents what will happen when a person clicks. The attacker uses layered elements, hidden controls, or misaligned targets so the click lands on a different action than the one the user intended.
How Click Spoofing Works
The technique usually depends on HTML and browser behaviour that lets one element sit above another, or lets an invisible control capture the event. Common patterns include transparent overlays, iframes, shifted buttons, and content that appears harmless until the user interacts with it.
Because the victim is acting through a normal browser session, click spoofing can bypass suspicion rather than technical defences. The page may look legitimate, but the click can trigger consent, payment, permission, navigation, or account-setting changes that the user never meant to approve.
Why Click Spoofing Is Dangerous
The main danger is that it turns trust in the interface into an attack surface. If the target click is tied to a sensitive action, the attacker can convert a simple interaction into authorisation for something harmful, including changing settings, launching a malicious download, or approving an unwanted transaction.
Click spoofing is especially effective when a user believes they are interacting with a familiar site or workflow. The attack does not need to break encryption or defeat authentication directly, it only needs to manipulate the point where user intent is translated into browser action.
Common Defences Against Click Spoofing
Defence starts with preventing the page from being framed or visually masked in ways that change user intent. Strong browser-side and server-side controls should limit cross-origin framing, block untrusted overlays, and require clear, deliberate interaction for sensitive actions.
High-risk workflows should also use step-up confirmation, origin checks, and interface designs that make dangerous actions harder to disguise. Security testing should include UI redress and framing abuse, not just traditional input and access-control checks.
Risk and Threat Considerations
Click spoofing matters because the attacker is not trying to break the browser, they are trying to redirect user intent. That makes the technique useful for permission abuse, fraudulent approvals, and hidden state changes that can look like legitimate user behaviour.
Failure mechanism: A deceptive visual layer captures the click or moves the effective target, so the browser executes a different action from the one the user believed they selected.
Impact: The result can be unauthorised changes, unwanted transactions, privilege-related actions, or other security-sensitive outcomes that appear to have been user initiated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V14 — Data Protection | Click spoofing can force unintended sensitive UI actions and state changes. |
| Recommendation — Require explicit confirmation and origin-safe interaction patterns for sensitive actions. | ||
| NIST SP 800-53 Rev 5 | SC-10 — Network Disconnections | Controls framing and embedded content that can alter user interaction context. |
| AC-3 — Access Enforcement | Deceptive clicks can trigger access-changing actions that must still be enforced server-side. | |
| Recommendation — Prevent untrusted framing of sensitive pages and workflows. Enforce authorization on the server for every privileged action. | ||
Practitioner Guidance
What to watch for: Treat any sensitive workflow that depends on a single click as a design risk, especially when the action changes permissions, approvals, billing, or trust relationships. The safer pattern is to make critical actions explicit, visible, and difficult to disguise through layered page content.
Practitioner takeaway: Click spoofing is less about code execution than about intent confusion, so the best controls are the ones that preserve what the user can plainly see and confirm before the action is accepted.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org