Keyboard Hijacking by Facemoji-Baidu Chinese App

Download Facemoji APK.

In the hyper-competitive world of mobile app marketing, organic installs are pure gold. They represent genuine user intent—users who actively search for and download your app without any paid prompting. They are cost-effective, loyal, and the foundation of sustainable growth.

But what if a popular, seemingly harmless app on a user’s phone was silently stealing that gold from right under your nose?

This is the serious allegation being leveled against Facemoji Keyboard, a widely-used third-party keyboard app. While it promises users a fun and customized typing experience, evidence and patterns strongly suggest it’s operating a sophisticated form of ad fraud, hijacking organic installs and draining marketing budgets.

The “Harmless” Disguise: What is Facemoji?

On the surface, Facemoji is a legitimate application. Available on Google Play and other stores, it offers users thousands of emojis, stickers, GIFs, and custom themes. With millions of downloads, it has a massive install base, which is precisely what makes its alleged fraudulent activity so potent.

The app’s power—and its weapon—is its nature as a keyboard. A keyboard is one of the most privileged apps on a smartphone. It has system-level access to see what you type, what apps you open, and how you interact with your device’s core functions, including the app store.

The Heist: Stealing Organic Search Through Click Injection

The method Facemoji is accused of using is a well-known type of mobile ad fraud called Install Hijacking or Click Injection.

Here’s how the deception works, step-by-step:

1. The Organic Intent: A user decides they want to download your app. They may have heard about it from a friend or seen it featured. They open the Google Play Store and search for your app by name, for example, “My Awesome Game.”
2. The Spy in Plain Sight: The Facemoji Keyboard, active on the user’s phone, is monitoring this activity. It detects that the user has searched for “My Awesome Game” and is on the app’s store page, showing a clear intent to install.
3. The Fraudulent Click: In the milliseconds between the user deciding to install and them actually tapping the “Install” button, Facemoji’s software springs into action. It programmatically fires a fake “click” to an ad network’s tracking link. This click falsely reports that the user just saw an ad for “My Awesome Game” served by Facemoji and “clicked” on it.
4. The Install: The user, completely unaware of the background chicanery, proceeds to tap “Install” and downloads your app organically, just as they intended.
5. The False Attribution: Your mobile measurement partner (MMP) like AppsFlyer, Adjust, or Kochava sees the data. According to the “last-click attribution” model—the industry standard—the last recorded click before the install gets the credit. In this case, it was the fraudulent click fired by Facemoji.
6. The Payout: Your system attributes this valuable organic install to Facemoji’s ad network. You then pay them a Cost Per Install (CPI) fee for a user you would have acquired for free.

Essentially, Facemoji is like a salesperson who watches a customer walk into a store to buy a specific product, and just before they get to the checkout, runs ahead, slaps their commission sticker on the item, and claims the sale.

The Damage Goes Beyond Money

The financial loss from paying for stolen organic users is significant, but the damage is much deeper:

• Corrupted Data & Skewed Metrics: The fraud pollutes your marketing data. You see Facemoji delivering what appears to be a high volume of quality installs with great conversion rates. This leads you to believe it’s a high-performing channel, so you allocate more budget to it, feeding the fraud in a vicious cycle. Your true ROAS (Return on Ad Spend) and LTV (Lifetime Value) calculations become completely unreliable.
• Wasted Marketing Budget: Every dollar spent on a fraudulent install is a dollar stolen from legitimate channels that could have driven actual growth.
• Erosion of Trust: This practice undermines the entire mobile advertising ecosystem, making marketers distrustful of their own data and their partners.

How to Protect Your App from Install Hijacking

As a developer or marketer, you are not powerless. It’s time to be vigilant and scrutinize your data.

1. Analyze Click-to-Install Time (CTIT): This is the most telling metric. Organic installs have a varied and often long CTIT. Hijacked installs, however, will have an abnormally short CTIT—often less than 10 seconds—because the click is “injected” just moments before the install begins. Look for publishers with a high concentration of installs in this sub-10-second window.
2. Scrutinize Your Sources: If a large percentage of your “paid” installs are coming from a single publisher like Facemoji, especially one known for keyboard inventory, raise the red flag.
3. Use Fraud Protection Suites: Ensure you have the advanced fraud protection features offered by your MMP enabled. These tools are specifically designed to detect and block anomalies like short CTITs and other signs of click injection.
4. Maintain a Blacklist: Be proactive. If a publisher or sub-publisher shows clear signs of fraudulent activity, block them immediately. Don’t wait for them to steal more of your budget.

It’s time for the industry to hold publishers like Facemoji accountable. By rewarding them with ad revenue, we inadvertently fund their deceptive practices. Marketers must prioritize transparency, rigorously analyze their data, and refuse to pay for stolen users. Your organic installs are your most valuable asset—don’t let a silent thief in a keyboard disguise walk away with them.