Click hijacking

Click hijacking is a type of attribution fraud in app advertising: malware on a phone detects that the user just clicked a real ad, then immediately sends a fake click under another source’s name so the install that follows is credited to the fraudster. The user and the install are both real. Only the credit is stolen.

Click hijacking belongs to the app and MMP attribution group of ad fraud. The overview page compares it with web, lead and affiliate fraud.

What is click hijacking?

App install campaigns usually credit the last click before the first app open, so a fraudster only needs to be last in line. The malware recognizes that a valid click just happened and sends its own click a few seconds later. When the user installs and opens the app, the injected click is now the last one.

AppsFlyer groups click hijacking and click injection under install hijacking, meaning the use of malware to take over install attribution, and notes that this malware often hides in legitimate-looking apps or in apps downloaded from third-party stores (AppsFlyer, Install hijacking, accessed October 2026). The MRC’s IVT standard places “infected and hijacked devices” and “hijacked measurement events” in sophisticated invalid traffic, the kind that takes advanced analysis to detect (MRC, IVT Standards Addendum, June 2020).

Why does it still matter in 2025 and 2026?

Google Play bans apps from sending fake attribution clicks to get paid for installs their network didn’t generate (Google Play Console Help, Ad Fraud, accessed October 2026). A large source of malware sits outside Play: in 2025, Google Play Protect detected more than 27 million new malicious apps from sources outside Google Play (Google Security Blog, February 2026). A phone that is already infected can still inject clicks into your campaign.

Because the installs are still real users, retention metrics raise no alarm. You pay the fraudulent source by mistake, while the real source looks weaker than it is and may have its budget cut.

How to detect click hijacking

• Two clicks close together: in raw data, look for installs that have a click from source A and then, just seconds later, a click from source B, with B winning. When the pattern keeps repeating with the same source B, that is a clear signal.
• Cross-check the Google Play referrer: Adjust uses a reference passed through the Play Store referrer to match an install to the exact click that sent the user to the store, and it prefers this match when a click can be matched by both the referrer and a device ID (Adjust Help Center, Attribution methods, accessed October 2026).
• Unusually short CTIT: clicks injected right before the app open push the distribution into the first few seconds. See CTIT.

Example (hypothetical)

A food delivery app runs ads on a large video network at a CPI of VND 20,000. A smaller network reports 800 installs for the month. In the raw data, 600 of them have a click from the video network only 2 to 5 seconds earlier. That means VND 12 million is going to the wrong source, and the video network is underreported by 600 installs.

Click hijacking vs. click injection vs. clickjacking

The first two columns are two branches of click fraud aimed at install attribution. Clickjacking is a different thing: Google Ads describes it as a fraudulent ad placement that tricks users into clicking invisible ads (Google Ads Help, About invalid traffic, accessed October 2026). Catching clicks while the app is installing is covered under click injection, and sending clicks in bulk under click flooding.

Frequently asked questions

Does click hijacking increase the number of installs?

No. Total installs stay the same. Only the credit moves to the fraudulent source, so you won’t spot it in the totals.

How should you handle a network you suspect?

Send the network a list of installs with the click timestamps from both sources, ask for an explanation and block sub-publishers that show the repeating pattern. Your contract should state that reconciliation is based on the MMP’s filtered data.

If you need someone to review the attribution data from your app install campaigns, contact Adtek through our contact page.