Scenario: 1. Victim opens the attacker's web site. 2. Attacker sets up a web site which contains interesting and attractive content like 'Do you want to make $1000 in a day?'. 3. Victim clicks to…

HTTP Parameter Pollution injects duplicate or unexpected HTTP parameters into requests to manipulate application logic, and does not involve iframe overlays or visual deception.

HTML Injection inserts unsanitized HTML markup into a vulnerable web page to alter its appearance or behavior, which is distinct from the transparent iframe overlay technique described.

Session Fixation forces a victim to authenticate using a session ID already known to the attacker to enable session hijacking, and does not involve invisible iframes or click redirection.

Clickjacking (also called a UI redress attack) works by placing an invisible or transparent iframe containing the attacker's target content directly over a legitimate-looking page element. When the victim clicks what appears to be the visible content, they are actually interacting with the hidden iframe, potentially triggering unintended actions such as form submissions, purchases, or permission grants. The standard mitigation is using the X-Frame-Options or Content-Security-Policy HTTP response headers.