Half-click is an attack pattern where simply opening a message, previewing content, or letting a mail client render it is enough to trigger malicious code or a browser-side exploit. Unlike classic phishing, it does not depend on the victim clicking a link, downloading a file, or enabling a macro. The exploit is activated by the act of viewing the message itself.
This matters because it turns the email reader into the attack surface. In webmail and rich-client environments, attacker-controlled content may be processed inside an authenticated session, which can expose cookies, mailbox data, or session state if a flaw such as cross-site scripting is present. Defenders reduce half-click risk with safe rendering, content filtering, patching, sandboxing, and by treating message preview as potentially dangerous input rather than passive text.