There is also a technique where they ask you to press: Win + R + CRTL + V + ENTER to verify that you are human.

This will install malware code that was put in the clipboard by using javascript.

The article’s headline says it’s a new technique. The article’s body does not really say this.

Lots of people suggesting that double click here means to click the mouse twice quickly but I believe it refers to clicking submit (once), then clicking the pop up button (once), to get two total clicks.

This is clever, and I got a good laugh out of their example video. The demo UI of "Double click here" isn't very convincing - I bet there's a version of this that gets people to double click consistently though. Show 3 replies

Back in 2013 I discovered that you could use clickjacking to trick someone into buying anything you wanted from Amazon (assuming they were signed in). It took them almost a year to fix the issue. They never paid me a bounty.

https://onlineaspect.com/2014/06/06/clickjacking-amazon-com/

Show 2 replies

I think the suggested mitigation will only work when the user double-clicks without moving the mouse.

So I'd try adding a small timeout when the tab is visible:

  document.addEventListener("visibilitychange", () => {
    if (!document.hidden)
      setTimeout(enableButtons, 200)
  })

Show 1 reply

And this is a great reason to us Firefox's containers feature.

It appears that you can replace double-click with command-click, and listen for keydown rather than mousedown.

This would be super effective as a form submit button that doesn’t respond, tricking the user into rage clicking

New fear unlocked lazy cookie consent banners.

In other words, a social engineering attack to trick people into authorizing something they did not want to authorize.

Related XKCD: https://www.explainxkcd.com/wiki/index.php/2415:_Allow_Captc...

Thankfully this shouldn't become a large problem, because websites simply don't load that quick Show 1 reply

I'm a little skeptical that this is a real exploit.

When I watched the Salesforce video, the exploit was demonstrated by pointing the browser at a file on disk, not on a public website. I also don't understand the "proof," IE, something showed up in the salesforce inbox, but I don't understand how that shows that the user was hacked. It appears to be an automated email from an identity provider.

I also don't understand when the popup is shown, and what the element is when the popup is closed.

Some slow-mo with highlighting on the fake window, and the "proof of exploit," might make this easier to understand and demonstrate

Show 1 reply

Am I mistaken or does this require the user to allow pop-ups? Show 1 reply

Title: DoubleClickjacking: A New Era of UI Redressing

Browser content should never be able to modify the configuration of my desktop window layout by opening a new window. There I said it. Show 3 replies

Bit off topic, but what's the reasoning behind messing with the native browser scroll here. Almost gets me motion sick when scrolling through this article. Show 4 replies

Eh, it's hardly seamless, and double clicking is extremely uncommon on the web so that would be a big red flag. Show 6 replies