User-agent spoofing is a technique used by attackers to impersonate a legitimate user agent or mobile application to bypass security controls. In this case, the back-end server was exposing an API that should have only been available from the company's mobile application. By spoofing the user agent, the attacker was able to trick the back-end server into believing that the API request was coming from the legitimate mobile application, and therefore, was able to bypass the security control that was supposed to restrict access to the API to only the mobile application.