CERT Polska Exposes Toll Fraud Ad Network: 1,235 Ads, 74 Profiles

CERT Polska published an investigation into a toll fraud campaign in which 1,235 unique Meta ads under 74 profile names promoted 29 Google Play apps. Google and Meta removed the ads and apps after the report, but the C2 infrastructure kept responding.

• 1,235 Meta ads under 74 profile names promoted 29 Google Play apps
• 532 ads linked to a confirmed toll fraud module
• 17 apps were promoted in 852 ads under 60 profiles
• One ad file with the same SHA-256 appeared in 55 ads