In a surprising advance in cyber techniques, clickjacking attacks have evolved in spectacular fashion, now incorporating the double-click action of the mouse to trick users and bypass security protections on web pages.
This method, known as ‘DoubleClickjacking‘, is a major concern for internet security. The attack takes advantage of the time lapse between the first and second click to introduce malicious elements into the user interface, manipulating what the person thinks they are selecting.
The technique is particularly effective because it does not rely on double-click speed, meaning that even users with slower or faster response times are vulnerable. This tactic has been used to redirect users to malicious sites, download malware or steal multi-factor authentication credentials without the victim realising it.
Recommendations to avoid this type of attack
This is how cybersecurity researcher Paulos Yibelo explains it in his blog: “One of the surprising things about doing it this way is that it doesn’t matter how slow or fast the target’s double click is. Favoring the mousedown event handler allows this to be exploited even for the fastest or slowest double clicks”.
Researchers and cybersecurity specialists have warned about the ability of this attack to bypass traditional protections against single-click attacks, demonstrating that any website, regardless of its level of security, can be a potential target. The warning extends not only to web pages but also to browser extensions, as these can be similarly exploited.
To try to eliminate or minimize these risks, users are advised to be more attentive to the actions they take online, avoid double-clicking on suspicious links and keep all programs and browsers up to date.