Stolen Credit: How Install Hijacking and Click Injection Tax App Marketers

The fraud that looks like success

When people imagine ad fraud, they usually picture bots: fake devices, fake clicks, fake users. That kind of fraud is real and costly. But it has a weakness from the fraudster's point of view. Fake users don't open the app again, don't buy anything and eventually show up as a cohort that never retains.

A quieter kind of fraud avoids that problem by using real users. It doesn't invent installs. It steals the credit for installs that were going to happen anyway.

This is called install hijacking. AppsFlyer describes it as a class of mobile fraud that uses malware to take over the attribution for an install [15]. The user is real, the install is real and the user may go on to become a valuable customer. The only thing that's fake is the claim about who brought them in.

How it works

App marketers pay partners, such as ad networks and affiliates, for the installs they drive. To decide who gets paid, measurement platforms usually credit the last ad a user interacted with before installing.

Install hijacking exploits that rule. The most common technique is click injection:

1. A user installs an app they found through search, word of mouth or a brand's own campaign.
2. Malware hidden inside another app on the same device detects that an installation has started.
3. The malware fires a fake ad click just before the install finishes, so the fraudster's click becomes the last touch [15].
4. The measurement system credits the fraudster, and the brand pays for an install it earned itself.

A related technique, sometimes called click flooding or click spamming, fires huge numbers of fake clicks in the hope that some will be the last touch before organic installs.

The brand's reports look healthy. Installs are coming in, many of those users are real and some of them even pay. That's what makes this fraud so hard to see.

How big is the problem?

Estimates vary with method and scope, but the scale is consistently large.

Across all digital advertising:

• AppsFlyer estimates that fraud drains roughly 12% of digital ad spend globally [11].
• Juniper Research, as reported by Search Engine Land, put losses at more than 22% of global digital ad spend, or about $84 billion, in 2023 [16].
• Losses have been projected to reach around $172 billion by 2028 [12].

In app installs specifically:

• AppsFlyer estimates that financial exposure to app install fraud exceeded $17 billion in 2024 [12].

The spread between 12% and 22% reflects different definitions and data sets. Even the lower figure is enough to wipe out the margin on many campaigns.

Where the fraud concentrates

AppsFlyer's State of Fraud for Marketers 2026, based on more than 100 billion installs across over 246,000 apps, adds two findings that matter for how brands allocate budget [10]:

1. The fraud gap between affiliates and self-reporting networks reached 36x. Self-reporting networks (SRNs) are the large platforms, such as Meta and Google, that measure and report their own results. Affiliate and smaller network traffic showed dramatically higher fraud rates. That doesn't mean every affiliate is fraudulent, but the risk is heavily concentrated outside the big platforms.

2. Organic installs account for 52% of all fraudulent installs. More than half of the installs flagged as fraud were users who would have come organically. In other words, most fraud isn't creating fake demand. It's charging brands for demand they already had.

Together these findings describe exactly the install hijacking pattern: fraud targets the channels with the least oversight and takes credit for the brand's own organic growth.

Seasonal spikes

Fraud also rises when budgets rise. AppsFlyer's analysis of the 2025 Indian festive season found that fraud rates climbed sharply after Diwali. On iOS, the food and drink category reached a 60% fraud rate, an increase of 176% [13].

The pattern is intuitive. When brands spend heavily in a short window, fraudsters follow the money and campaigns are scaled too fast for anyone to check the traffic carefully.

The hidden costs

The direct cost of fraud is the money paid for installs that weren't earned. The indirect costs are often larger.

Budget moves to the wrong places. If a fraudulent partner appears to deliver cheap installs, optimisation moves more money towards it. Fraud rewards itself.

Organic growth is undervalued. When stolen installs are credited to paid channels, the brand's organic growth looks weaker than it is. That can lead to overspending on acquisition and underinvesting in product and retention.

Performance data is poisoned. Every model trained on attribution data learns the wrong lessons if a meaningful share of that data is misattributed. Future decisions inherit today's fraud.

Trust erodes. Brands that discover fraud often pull back from whole categories of partners, including legitimate ones. That shrinks the pool of real supply and pushes more budget into a few large platforms.

What reduces the risk

No single step eliminates attribution fraud, but several consistently cut it down.

1. Look at the time between click and install. Genuine clicks produce a natural spread of times before the install. Click injection shows up as a cluster of clicks seconds before the install completes.
2. Watch for unusually high organic overlap. If a partner's users look just like your organic users, including brand-search behaviour, retention and geography, ask why you're paying for them.
3. Pay for outcomes that are hard to fake. Paying for installs invites install fraud. Paying for purchases, retained users or return on ad spend (ROAS) makes fraud much harder to profit from.
4. Shorten the supply chain. Buying directly from vetted publishers with committed inventory reduces the number of hands a click passes through.
5. Test incrementality. Switching a channel off in a controlled way is the most reliable test of whether it creates new users or only takes credit for existing ones.

Why this matters for the whole ad-tech debate

Install hijacking is a clear example of a broader problem: when intermediaries are paid on what they can claim credit for, rather than on what they create, some will game the claim. The 36x gap between affiliate and SRN fraud rates [10] isn't a verdict on every affiliate. It's evidence that less transparent parts of the chain attract the most abuse.

For marketers, the lesson isn't to abandon everything outside the largest platforms. Some of the most efficient supply, such as direct publisher and OEM deals, sits there. The lesson is to demand proof: proof that a user was new, proof that the credit is genuine, and pricing that rewards real outcomes rather than claimed ones.

The takeaway

The most expensive fraud in app marketing doesn't always involve fake users. Often it involves real users and fake credit. With more than half of fraudulent installs being organic users the brand already had [10], the question for every marketer isn't just "are these installs real?" It's "would they have come anyway?"

---

References

[10] AppsFlyer. State of Fraud for Marketers, 2026 edition. April 2026. https://www.appsflyer.com/resources/reports/state-fraud-marketers/

[11] AppsFlyer. Ad fraud data insights. April 2026. https://www.appsflyer.com/blog/measurement-analytics/ad-fraud-data-insights/

[12] AppsFlyer. AI and ad fraud innovation. March 2025, updated November 2025. https://www.appsflyer.com/blog/mobile-fraud/ai-ad-fraud-innovation/

[13] AppsFlyer. India festive season report (press release). August 2025. https://www.appsflyer.com/company/newsroom/pr/india-festive-apsflyer-report-2025/

[15] AppsFlyer. Install hijacking (glossary). https://www.appsflyer.com/glossary/install-hijacking/

[16] Search Engine Land (citing Juniper Research). $84 billion lost to ad fraud: what you missed about affiliate abuse in 2025. June 2025. https://searchengineland.com/84-billion-lost-to-ad-fraud-what-you-missed-about-affiliate-abuse-in-2025-456530