Click spam — also called click flooding — is a mobile [[ad-fraud]] technique. The fraudster reports a high volume of clicks that never really happened, for devices the user never engaged. On a last-click attribution model, if any of those fake clicks happens to land shortly before the user installs the app organically, the fraudster "wins" the attribution and collects a payout they didn't earn.
How it steals installs
Click spam is a numbers game: blast enough fake clicks across enough devices and, statistically, some will precede a genuine organic install. The fraudulent network then claims credit for installs that would have happened anyway — siphoning budget from [[organic-installs]] and from honest networks. It needs no real user interaction, just volume.
Detection centers on the [[click-to-install-rate]] and especially the click-to-install-time (CTIT) distribution. Genuine ad clicks produce a CTIT curve that peaks within minutes and decays; click spam produces a suspiciously flat, long-tailed distribution because the "clicks" have no real relationship to the installs they're claiming. MMP fraud tools flag these patterns and reject the attributions.
Click spam vs click injection. Click spam is blind volume fired in advance. Click injection is more surgical: on Android, malware detects the exact moment an install begins and fires a click right then to win last-click attribution. Both hijack credit; injection is more precise and harder to spot on CTIT alone.