Poland's CERT Polska has disrupted an Android toll fraud campaign that relied on paid Meta ads to lure users into installing malicious apps from Google Play. The investigation documented 1,235 Meta ads, of which 852 promoted 17 apps tied to the operation. Six apps contained confirmed toll fraud components, while the other 11 shared malicious loaders whose final payloads could not be recovered.
The malware enrolled victims in paid services without consent, either by sending premium-rate SMS messages or automating carrier billing flows. One observed route sent generated keywords to premium short codes, which CERT verified against the Polish regulator's register. Three such codes charged 30.75 PLN ($7.97) per message, while a separate carrier billing offer charged 17 PLN ($4.41) every seven days.
The campaign began with fake PDF-expiration warnings that led to Messenger Pro, an SMS app with a hidden loader. That loader decrypted code at runtime, contacted a policy server, and downloaded the final fraud payload from Alibaba Cloud. CERT reported the apps to Google, which removed them from Play, and Meta took down the reported ads. However, the command-and-control infrastructure stayed active, and new packages appeared after the takedowns, leaving affected users responsible for manually removing the apps from their devices.