{"id":6919,"date":"2026-10-20T21:40:10","date_gmt":"2026-10-20T14:40:10","guid":{"rendered":"https:\/\/adtek.agency\/glossary\/click-hijacking\/"},"modified":"2026-10-22T17:53:18","modified_gmt":"2026-10-22T10:53:18","slug":"click-hijacking","status":"publish","type":"mona_glossary","link":"https:\/\/adtek.agency\/en\/glossary\/click-hijacking\/","title":{"rendered":"Click hijacking"},"content":{"rendered":"

Click hijacking is a type of attribution fraud in app advertising: malware on a phone detects that the user just clicked a real ad, then immediately sends a fake click under another source’s name so the install that follows is credited to the fraudster. The user and the install are both real. Only the credit is stolen.<\/p>\n

Click hijacking belongs to the app and MMP attribution group of ad fraud<\/a>. The overview page compares it with web, lead and affiliate fraud.<\/p>\n

What is click hijacking?<\/h2>\n

App install campaigns usually credit the last click before the first app open, so a fraudster only needs to be last in line. The malware recognizes that a valid click just happened and sends its own click a few seconds later. When the user installs and opens the app, the injected click is now the last one.<\/p>\n

AppsFlyer groups click hijacking and click injection under install hijacking, meaning the use of malware to take over install attribution, and notes that this malware often hides in legitimate-looking apps or in apps downloaded from third-party stores (AppsFlyer, Install hijacking, accessed October 2026<\/a>). The MRC’s IVT standard places “infected and hijacked devices” and “hijacked measurement events” in sophisticated invalid traffic, the kind that takes advanced analysis to detect (MRC, IVT Standards Addendum, June 2020<\/a>).<\/p>\n

Why does it still matter in 2025 and 2026?<\/h2>\n

Google Play bans apps from sending fake attribution clicks to get paid for installs their network didn’t generate (Google Play Console Help, Ad Fraud, accessed October 2026<\/a>). A large source of malware sits outside Play: in 2025, Google Play Protect detected more than 27 million new malicious apps from sources outside Google Play (Google Security Blog, February 2026<\/a>). A phone that is already infected can still inject clicks into your campaign.<\/p>\n

Because the installs are still real users, retention metrics raise no alarm. You pay the fraudulent source by mistake, while the real source looks weaker than it is and may have its budget cut.<\/p>\n

How to detect click hijacking<\/h2>\n