An attacker embeds the target application in a transparent iframe overlaid on a decoy page, tricking users into clicking hidden UI elements and performing unintended actions.
Immediate Response
1Add X-Frame-Options: DENY or SAMEORIGIN headers to all application responses.
2Deploy a Content-Security-Policy with frame-ancestors directive restricting embedding origins.
3Audit logs for suspicious user actions that may have resulted from clickjacking.
4Notify affected users if unauthorized actions were performed on their accounts.
