Many efforts have been made on developing adversarial attack methods on point clouds. However, without fully considering the geometric property of point clouds, existing methods tend to produce clearly visible outliers. In this paper, we propose a novel NormalAttack framework towards imperceptible adversarial attacks on point clouds. First, we enforce the perturbation to be concentrated along normals to deform the underlying surface of 3D point clouds, such that tiny perturbation can make the shape deformed for better attack performance. Second, we guide the perturbation to be located more on regions with larger curvature, such that better imperceptibility is achieved. Extensive experiments on three representative networks, e.g., PointNet++, DGCNN, and PointConv, validate the effectiveness of NormalAttack and its superiority to state-of-the-art methods.