1. A computer-implemented method comprising: creating a plurality of software development kit (SDK) class tree structures of a plurality of malicious SDKs, the SDK class tree structures comprising a plurality of nodes that each represents a class of a corresponding malicious SDK and indicates a class feature of the corresponding malicious SDK that is used in execution of a target mobile app created or repackaged using the corresponding malicious SDK; receiving a mobile app; creating an app class tree structure of the mobile app, the app class tree structure comprising a plurality of nodes that each represents a class of the mobile app and indicates a class feature of the mobile app that is used in execution of the mobile app; comparing the app class tree structure against the plurality of SDK class tree structures to find an SDK class tree structure that matches the app class tree structure; detecting that the mobile app has been created or repackaged using at least one of the plurality of malicious SDKs based on comparing the app class tree structure against the plurality of SDK class tree structures; and performing a security action in response to detecting that the mobile app has been created or repackaged using the at least one of the plurality of malicious SDKs.