What method do attackers use to obscure a harmful link under a legitimate facade?

The correct method that attackers use to obscure a harmful link under a legitimate facade is clickjacking. This technique involves tricking a user into clicking on something different from what the user perceives, thereby enabling the attacker to manipulate the user's actions without their knowledge.

In clickjacking, the attacker may overlay a transparent frame over a legitimate webpage. When the user attempts to interact with what appears to be a benign element, they are actually clicking on the hidden layer, which could lead to unwanted actions such as revealing personal information or executing malicious commands. This method relies heavily on the visual deception of the displayed content, making it difficult for users to discern the true nature of their actions.

Other methods, while they involve deceptive tactics, do not specifically rely on obscuring links the way clickjacking does. Phishing typically involves direct attempts to deceive users by imitating legitimate communications to steal sensitive data. URL masking may also hide the true destination of a link but does not require the layering technique characteristic of clickjacking. Social engineering encompasses a broader range of psychological manipulation techniques to persuade individuals into performing actions, but it does not specifically describe the process of obscuring harmful links through deceptive visuals.