While performing online banking using a Web browser, Kyle receives an email that contains an image of a well-crafted art. Upon clicking the image, a new tab on the web browser opens and shows an anima

Clickjacking is a UI redress attack that overlays transparent iframes on legitimate page elements to trick users into clicking hidden controls - it does not exploit authenticated sessions from an external site.

Web Form Input Validation is a defensive technique for sanitizing form data to prevent injection attacks; it is not an attack type and does not describe the exploitation of an active banking session.

CSRF exploits the trust a web application places in an authenticated user's browser. While Kyle was logged into his bank, the malicious image link issued hidden HTTP requests to the bank's server carrying his valid session cookies, causing the server to process unauthorized transactions as if Kyle had initiated them.

Cross-Site Scripting injects malicious scripts into a trusted site's pages to execute in other users' browsers, which differs from leveraging an existing authenticated session to forge requests to the bank.