Myth Busting: Why "Innocent Clicks" Don't Exist in Cybersecurity

In a recent Unit 42 myth busting piece, the author argues that “innocent clicks” do not exist in cybersecurity, illustrating how simply visiting a link or scanning a QR code can expose devices to risk. The article describes scenarios such as a parking-lot QR payment page that looks suspicious, where attackers can use drive-by downloads, browser exploits, or JavaScript to run arbitrary code and break out of the browser sandbox.

It also highlights digital fingerprinting as a risk, noting that attackers can collect information like IP address, location, and browser metadata to aid tracking or targeted advertising. The piece warns that even if a user does not enter data or interact with prompts, loading a malicious page can still compromise a device.

It provides practical steps, including keeping devices up to date, avoiding unknown QR codes and links, inspecting URLs, and using URL unshorteners or tools like VirusTotal to check a link’s safety, with the guidance presented by Unit 42 and authored by Reethika Ramesh and published on 16 September 2025. According to Unit 42, the recommendation to navigate via trusted search engines rather than clicking unknown codes is emphasised to reduce exposure.