While performing online banking using a Web browser, Kyle receives an email that contains an image of a well-crafted art. Upon clicking the image, a new tab on the web browser opens and shows an anima

Clickjacking tricks users into clicking a hidden or overlaid UI element on a legitimate page, but this attack did not involve overlaying a transparent frame over a target site.

Web Form Input Validation refers to sanitizing user-supplied data to prevent injection attacks - it does not describe an attacker exploiting an authenticated session.

Cross-Site Request Forgery (CSRF) exploits the trust a web application has in an authenticated user's browser. When Kyle clicked the image, the attacker's page silently issued a forged HTTP request to the banking site using Kyle's active session cookies, causing the bank to process a fund transfer as if Kyle had authorized it. The animated GIF served as a distraction while the malicious request completed in the background.

Cross-Site Scripting (XSS) involves injecting malicious scripts into a trusted web page viewed by other users, which is not what occurred here - no script was injected into the banking site itself.