How do you prevent CAPEC-173?

Avoid interacting with suspicious sites or clicking suspicious links.

What weaknesses does CAPEC-173 target?

CAPEC-173 exploits 1 CWE weakness, including CWE-451 (User Interface (UI) Misrepresentation of Critical Information).

How severe is CAPEC-173?

MITRE rates CAPEC-173 as Very High severity with high likelihood of attack.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Meta attack pattern

Stable

CAPEC-173: Action Spoofing

An adversary is able to disguise one action for another and therefore trick a user into initiating one type of action when they intend to initiate a different action. For example, a user might be led to believe that clicking a button will submit a query, but in fact it downloads software. Adversaries may perform this attack through social means, such as by simply convincing a victim to perform the action or relying on a user's natural inclination to do so, or through technical means, such as a clickjacking attack where a user sees one interface but is actually interacting with a second, invisible, interface.

Last updated June 1, 2026

Very High

Typical severity

Per MITRE

High

Likelihood of attack

Per MITRE

1

Related weaknesses

CWEs this targets

Overview

CAPEC-173 (Action Spoofing) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The adversary must convince the victim into performing the decoy action.
The adversary must have the means to control a user's interface to present them with a decoy action as well as the actual malicious action. Simple versions of this attack can be performed using web pages requiring only that the adversary be able to host (or control) content that the user visits.

Consequences

What a successful CAPEC-173 attack can achieve.

Other

Affects: Confidentiality, Integrity, Availability

Action spoofing can result in a wide variety of consequences and negatively affect all three elements of the security triad.

How to mitigate it

Defenses that reduce the risk of CAPEC-173.

Avoid interacting with suspicious sites or clicking suspicious links.
An organization should provide regular, robust cybersecurity training to its employees.

Frequently asked questions

Common questions about CAPEC-173.

What is CAPEC-173?: An adversary is able to disguise one action for another and therefore trick a user into initiating one type of action when they intend to initiate a different action. For example, a user might be led to believe that clicking a button will submit a query, but in fact it downloads software. Adversaries may perform this attack through social means, such as by simply convincing a victim to perform the action or relying on a user's natural inclination to do so, or through technical means, such as a clickjacking attack where a user sees one interface but is actually interacting with a second, invisible, interface.
How do you prevent CAPEC-173?: Avoid interacting with suspicious sites or clicking suspicious links.
What weaknesses does CAPEC-173 target?: CAPEC-173 exploits 1 CWE weakness, including CWE-451 (User Interface (UI) Misrepresentation of Critical Information).
How severe is CAPEC-173?: MITRE rates CAPEC-173 as Very High severity with high likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-173

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing