Which technique uses a 1×1 pixel iframe under the mouse cursor to register clicks on the malicious page?

• A. Rapid Content Replacement
• B. DNS Rebinding Attack
• C. Hidden Overlay
• D. Load Balancer

Answer: (C)

This relies on clickjacking using a hidden overlay. The attacker places an invisible element—often a transparent or near-invisible 1×1 pixel iframe—right under the user’s cursor. When the user thinks they’re clicking a control on the malicious page, the click actually goes to the content inside that tiny iframe, which can trigger actions on another site or on a trusted page without the user realizing it. The overlay is hidden from view, so the user remains unaware of the real target of their click.

This fits because a hidden overlay is exactly the technique of using an unseen frame to intercept clicks. The other options aren’t about deceiving user clicks with an invisible frame: rapid content replacement isn’t about overlaying clicks, DNS rebinding targets DNS and network boundaries, and a load balancer is an infrastructure component, not a UI-based deception technique. Defenses include preventing framing (X-Frame-Options or CSP frame-ancestors) and user awareness to mitigate clickjacking.