This is the page which is presented to the user.
Now he only has to be lured to click on the link to trigger the funktion on the target page.
A little bit social engineering is enough...
... as seen here - You would click also, or not?
Please klick here!The same with invisible iframe.