Twitter (a popular microblogging site) has been trying to fend it off, after it went under attack twice. Clickjacking is the latest hazard doing round on the web.

Twitter users first noticed the clickjacking prank in February and soon Twitter had shut it down. The site had tweets that carried a tag ‘Don’t Click’ followed by a link. Clicking the link took the user to a page that included a button that said ‘Don’t Click.’ Clicking the button automatically distributed the identical tweet. As imagined, this did spread pretty quickly.

Simply put clickjacking is an attack where some bad guy slips a malicious link invisibly onto a webpage or under a commonly used button on a website. When the user clicks on the link or rolls his mouse over the link, he becomes infected, explained security experts.

Although Twitter’s original fix wiped a page clean if it detected a malicious frame on its pages, but then hackers circumvented that and Twitter was forced to come up with another fix.

It is concealed spying, say security experts. “Web pages know what web sites you’ve been to …, where you’re logged in, what you watch on YouTube, and now they can literally ’see’ and ‘hear’ you,” wrote Jeremiah Grossman, founder and CTO of WhiteHat Security, in his blog post.

The threat has only grown with every passing day. Now, every big company that values its brand name is working to fend off clickjacking attacks. For instance, Microsoft has included a new clickjacking protection feature in Internet Explorer 8 that lets websites safeguard their sites and visitors without browser add-ons.  Adobe Systems too updated its popular Flash Player to fix vulnerabilities over clickjacking. Clickjacking is both a web and a browser problem, but the fixes are likely to come from the browser vendors.

To make matters worse, using JavaScript, an attacker could make the invisible target constantly follow the user’s mouse pointer, thereby intercepting his first click no matter where it happens on the current page. The latest version of NoScript, a Firefox browser plugin that blocks Flash, Java, and JavaScript, includes a new anti-clickjacking feature called ClearClick. It reveals transparent or concealed windows so the user can see attempts to co-opt clicks for malicious purposes.

Quite clearly clickjacking can turn into the worst sort of security risk. Why? Because it is transparent to the unwitting user, simple to implement and difficult to stop.