CERT Polska: Meta ads funneled Polish users into premium-rate billing scam
CERT Polska disrupted an Android toll fraud campaign in which 852 of 1,235 Meta ads promoted 17 Google Play apps tied to premium SMS and subscription billing. Three short codes charged 30.75 PLN per message, while Teleaudio billed 17 PLN every seven days. Google removed the apps and Meta pulled the ads, but the command-and-control infrastructure kept running.
- 852 of 1,235 Meta ads promoted 17 malicious Google Play apps
- Short codes charged 30.75 PLN per SMS; Teleaudio billed 17 PLN every 7 days
- Messenger Pro's loader decrypted a DEX and pulled payloads from Alibaba Cloud
- Google removed the apps, but C2 servers kept issuing jobs
Read next
Security