Click injection

Click injection began as a mobile app fraud: a malicious app notices that the user is installing another app and fires a fake ad click at the last second, so the fraudster is credited with causing the install.

The same idea appears around search feeds. Software on the device, such as adware or a rogue browser extension, generates a click or a search that the person did not choose. The user may be reading something else entirely while the program triggers a visit to a lander or a click on a sponsored listing. Because it happens on a real person's device, on a real network, it looks human.

The tell-tale signs are in timing and context: clicks with no page interaction before them, clicks arriving faster than a person could read, and referrer or Click ID data that does not fit a normal journey. Advertisers see visits that leave instantly.

Defences are conceptual here: measure the time and events between page load and click, compare claimed and observed device signals, and judge sources on advertiser conversion quality. It is a form of SIVT, closely related to click spam and search hijacking.

Think of it like this

It is a tout who slips his business card into your hand just as you walk into a shop you were already going to, then claims commission for bringing you.