glossary
SDK Spoofing
SDK Spoofing is a mobile ad fraud technique where attackers manipulate tracking SDKs to generate fake clicks, installs, and in-app events. Also called traffic spoofing or replay attacks.
Quick Definition
SDK Spoofing is a mobile ad fraud technique where attackers manipulate tracking SDKs to generate fake clicks, installs, and in-app events. Also called traffic spoofing or replay attacks.
What is SDK Spoofing
SDK spoofing targets the communication layer between your tracking SDK and attribution backend.
Fraudsters reverse-engineer the SDK’s URL calls. Then they replay those calls at scale to simulate legitimate user actions.
The fraud looks real in your dashboard. Fake installs. Fake engagement. Real budget drain.
How It Works
The attack exploits SSL encryption between the tracking SDK and backend server.
The process:
- Fraudster installs your app and captures SDK network traffic
- Reverse-engineers the URL structure and authentication patterns
- Builds scripts to replay those calls with modified parameters
- Generates thousands of fake events that look identical to real ones
Your attribution platform sees properly formatted requests. Encrypted. Authenticated. Indistinguishable from legitimate traffic.
Until you look at the patterns.
Detection Signals
SDK spoofing leaves fingerprints:
Traffic patterns:
- Sudden spikes in installs from specific sources
- Abnormally high conversion rates (too perfect to be real)
- Install volumes that don’t match market capacity
Device behavior:
- Same device IDs generating events across multiple geos
- Repetitive event sequences (exact timing, exact order)
- Events firing without corresponding app opens
Geographic anomalies:
- Installs from regions with no ad spend
- IP addresses that don’t match claimed device location
- Time zones that contradict reported geography
Conversion discrepancies:
- Attribution platform shows installs, but app store shows nothing
- High install numbers, zero actual DAU growth
- Events fire before app could physically download
Prevention Solutions
SDK signature verification stops most attacks.
Modern SDKs include cryptographic signatures that prove requests came from legitimate app installations. Each SDK instance gets unique keys that can’t be easily reverse-engineered.
What works:
- Use MMP signature verification – Adjust, AppsFlyer, and Singular all offer SDK signature features
- Implement unique cryptographic libraries – Custom encryption per app build
- Certificate pinning – Prevent man-in-the-middle traffic capture
- Server-side validation – Check device fingerprints against known patterns
- Install validation – Cross-reference attribution data with app store receipts
Update your SDK. Older versions lack modern fraud protections.
Common Mistakes
Trusting encryption alone. SSL doesn’t stop replay attacks. The fraudster isn’t decrypting traffic, they’re copying it.
Ignoring impossible conversion rates. If your install-to-purchase rate suddenly hits 40%, you’re not winning. You’re being spoofed.
Not validating with app stores. Your MMP shows 10K installs but Google Play shows 2K downloads? That gap is fraud.
Treating all traffic sources equally. SDK spoofing often concentrates in specific networks. Track fraud by source.
Delaying investigation. Every day you wait costs real budget on fake users.
Related Terms
- Click Injection – Another SDK manipulation technique
- Attribution Fraud – Broader category of install fraud
- Install Hijacking – Claims credit for organic installs
- Bot Traffic – Automated fake engagement
External Resources
Frequently Asked Questions
What is SDK spoofing?
A mobile ad fraud technique where attackers reverse-engineer a tracking SDK’s URL calls and replay them at scale to simulate legitimate clicks, installs, and in-app events.
How is SDK spoofing different from click injection?
Click injection manipulates real devices in real time. SDK spoofing simulates the SDK itself on servers, generating fake traffic at scale without any real device involved.
Can SDK spoofing bypass app store verification?
No. SDK spoofing creates fake attribution events, but it can’t create actual app store downloads. Cross-referencing attribution data with app store receipts catches the gap.
What percentage of mobile ad spend is lost to SDK spoofing?
App install farms and SDK spoofing together account for roughly 42% of all ad fraud, the largest single category, with worst-case single campaigns seeing SDK spoofing account for over 80% of total traffic. Gaming apps running high-CPI campaigns attract more of this fraud.
