What is SDK spoofing?
SDK spoofing is a mobile fraud in which criminals send fake install and in-app event messages directly to an attribution provider's servers, imitating the measurement SDK inside a real app. No device, app or user is involved; the fraudster simply fabricates convincing data so an advertiser pays for installs and purchases that never happened.
Mobile apps include an SDK from their MMP that reports installs and events. If fraudsters reverse-engineer how that SDK talks to its servers, they can replay or forge the messages from a server farm. SDK spoofing became prominent around 2017–2018, when measurement providers reported large volumes of perfectly formed but fake installs.
The main countermeasure is cryptographic signing: modern SDKs sign each message with a secret that is hard to extract, and servers reject unsigned or tampered payloads. Advertisers should confirm their MMP enforces signing and watch for cohorts with zero retention or impossible event patterns, signs of install fraud regardless of method.