A half-click exploit is an attack that can trigger with very little user interaction, sometimes only by opening a message or previewing content. Unlike classic phishing that depends on a full click or file launch, the malicious code is embedded in the content itself and activates when the vulnerable app renders it. In webmail and messaging systems, that can mean the browser or mail client becomes the execution environment.
This matters because it lowers the barrier for initial compromise and makes attacks easier to miss. A half-click flaw can be used to run script in an authenticated session, steal data, change mailbox settings, or plant a persistent web backdoor. Defenders should treat message rendering paths as attack surface: patch the vulnerable service, monitor for suspicious session behavior, inspect mailbox rules and configuration changes, and assume that password resets alone may not remove access if the attacker’s logic survives in the mail environment.