Expert Sounds Alarm Over Double-Click Cyberattacks on Major Browsers

Cyberthreat. A new and “extremely rampant” cyberthreat has emerged that involves exploiting mouse double-click timing to bypass protections on web browsers and trick users into authorizing unintended actions such as sharing sensitive data or approving malicious app access, according to cybersecurity expert Paulos Yibelo.

Dubbed “double clickjacking,” the new threat manipulates browser users into unknowingly interacting with sensitive elements, such as login authorizations or account permissions, by seamlessly switching the context of a webpage during a double-click action, according to Yibelo, who detailed the exploit in a recent blog post.
Double clickjacking attacks typically begin with a malicious webpage presenting an innocuous prompt, such as a CAPTCHA or a verification request, asking the user to double-click to proceed. When the user clicks the first time, the attack triggers a new browser window to open while manipulating the original window’s content. In the split second between the user’s first and second clicks, the original content is replaced with sensitive elements like permission requests or account authorization dialogs. The second click interacts with the replaced content, authorizing actions the user never intended to approve.