Remove your site(s) from the allowed sites list if you are using it. If you aren't using it, then use it, and don't list your site that is under attack in the list. Just put
google.com or some generic site in the list. This will stop any charges being made to the advertisers who are getting these bad clicks on their ads, and protect your AdSense account from possible disabling. See the link below if unfamiliar (allowed sites).
Then, read the thread in the second link below on how to best respond to click bomb attacks. When you have determined where the clicks are coming from, and have figured out how to stop them, make a detailed invalid click report to AdSense with as much data as you can find and provide - ip addresses, networks or geo-location the clicks are coming from (the more you can ID the attacker, the better). Use .htaccess file to block that IP/ISP or whatever you can do to keep the clicker or clickbot away from your site. Details of this are in the second link. Move quickly to stop the clicks counting first (allowed sites list), then read carefully in the second link. I wish you success in stopping the attack. It can be done!
References:
[1]
How do I add sites to my Allowed Sites list? - AdSense Help - Google (Help Articles)
Query used:
allowed sites list
[2]
The crash course emergency strategy for click bombing attacks - Google(Help Articles)
Query used:
crash course click bomb attack survival
