There's a 1×1 pixel iframe on this page. You can't see it. It's loading a login form from another domain, and it just recorded your keystrokes. That's the basic idea behind hidden iframe attacks — and the reason this is one of the most underestimated threats on the web.
(Don't worry — there isn't actually a hidden iframe on this page. But on thousands of compromised sites, there is.)
In 2024, researchers at Zscaler identified over 30,000 websites actively serving hidden iframes for clickjacking, credential theft, and cryptocurrency mining. Many had been compromised for weeks or months without the site owners knowing.
An iframe is just an HTML element that embeds another web page inside the current page. You see them everywhere — YouTube videos, Google Maps, Stripe payment forms. That's all fine. The problem starts when an iframe is deliberately made invisible.
Here's what a hidden iframe looks like in the page source:
The last one is particularly nasty. It covers the entire page but is completely invisible. Every click you make on the "real" page is actually clicking on whatever is in that iframe.
A transparent iframe is layered over a page. When you click what you think is a "Play Video" button, you're actually clicking "Confirm Transfer" in a banking interface loaded inside the invisible iframe. Facebook's "Like" button was a classic clickjacking target for years.
A hidden iframe loads a fake login form that overlays the real login fields on the page. You type your password thinking you're logging into the real site, but your keystrokes are going to the attacker's form in the invisible iframe.
A zero-dimension iframe loads a page running a cryptocurrency miner (like the now-defunct Coinhive). The mining code runs using your CPU, slowing down your computer while generating revenue for the attacker. You see nothing in the browser.
Hidden iframes load ad networks and "view" advertisements invisibly. The site owner (or the attacker, if the site is compromised) collects ad revenue from impressions that no human ever saw. This is a multi-billion dollar industry.
Let's walk through how a clickjacking attack actually works. Say you're on a malicious page that shows a "Win a Free iPhone" button.
The entire attack takes a single click. No malware, no phishing page, no stolen password needed — just an invisible iframe and a click on the wrong button.
The X-Frame-Options header and Content-Security-Policy: frame-ancestors directive let websites opt out of being framed. Banks and security-conscious sites set these headers. But many sites don't — and even when they do, misconfigurations leave gaps. The defense needs to work on both sides: the site preventing framing, and the browser detecting suspicious iframes.
Hidden iframes occupy a blind spot in most security tools:
X-Frame-Options) prevent a site from being loaded in an iframe — but they only protect the framed site. They don't protect you from iframes injected into the page you're visiting.The gap is clear: nothing in the standard security stack inspects iframes from the user's perspective and asks "Is this iframe trying to be invisible?"
PhishClean's Hidden iFrame Detection signal inspects every iframe on every page you visit. It checks for the patterns that indicate an iframe is deliberately hidden:
opacity: 0 or visibility: hidden that still load active contentVisible iframes from trusted sources (YouTube, Maps, payment processors) are ignored. PhishClean only flags iframes that are both hidden and loading suspicious content.
The entire analysis runs locally. Your browsing data stays on your device.
Injected scripts that steal form data — another invisible attack on legitimate sites.
Hidden iframes sometimes load HTTP content inside HTTPS pages, creating mixed-content vulnerabilities.
Hidden iframes can load phishing forms that overlay real login pages.
Chrome doesn't detect hidden iframes. See what 15 local detection signals cover.
Are iframes always dangerous?
Not at all. Iframes are a standard HTML feature used legitimately across the web. YouTube embeds, Google Maps, Stripe payment forms — they all use iframes. The danger is specifically with hidden iframes: ones that have zero dimensions, are positioned off-screen, or are fully transparent. A visible iframe from a trusted source is perfectly fine.
Can iframes steal my passwords?
Not directly — browsers enforce same-origin policy, so an iframe from a different domain can't read what you type on the parent page. But hidden iframes enable indirect attacks: clickjacking tricks you into interacting with an invisible iframe, transparent iframes can overlay fake input fields on top of real ones, and credential-harvesting iframes can present login forms that look like they belong to the page.
Do ad blockers stop hidden iframe attacks?
They stop some. Ad blockers maintain lists of known advertising and tracking domains, so iframes from those domains get blocked. But they don't detect hidden iframes from new or unknown domains, and they can't identify when a legitimate domain has been compromised. PhishClean checks iframe properties (size, visibility, position) regardless of the source, catching what ad blockers miss.
PhishClean detects hidden iframes on every page — clickjacking overlays, zero-pixel trackers, and off-screen loaders. 3-day free trial, no credit card required.
Install PhishClean