Comment by ryan-c

The fact that the debugger API is active is almost certainly detectable. I haven't tried recently, but it's been possible in older versions - and I've yet to come across a spoofing tool that I couldn't find a way to detect.