Full Report
CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852 to 17 applications through code or infrastructure, reconstructed the complete execution chain, and observed live premium SMS and carrier billing tasking.
Analysis Summary
# Incident Report: Multi-Stage Toll Fraud Operation targeting Poland
## Executive Summary
CERT Polska identified a sophisticated toll fraud operation leveraging deceptive Meta (Facebook) advertisements to drive users toward malicious applications on the Google Play Store. The campaign utilized a multi-stage execution chain to enroll victims in unauthorized premium SMS and carrier billing services, resulting in direct financial loss. At least 17 applications and 1,235 advertisements were linked to this coordinated effort, which bypassed initial platform security filters through remote payload delivery.
## Incident Details
- **Discovery Date:** 14 September 2026
- **Incident Date:** September 2026 (Ongoing at time of report)
- **Affected Organization:** Users of Meta and Google Play platforms
- **Sector:** Telecommunications / Mobile Users
- **Geography:** Poland (Primary target, MCC 260)
## Timeline of Events
### Initial Access
- **Date/Time:** September 14, 2026
- **Vector:** Deceptive Advertising (Malvertising)
- **Details:** Attackers placed ads on Meta platforms (Facebook) featuring false warnings that a user's "PDF application had expired." These ads redirected users to legitimate Google Play Store listings for malicious apps like `Messenger Pro`.
### Lateral Movement
- **Details:** N/A (Attack focused on external consumer mobile devices rather than corporate network lateral movement).
### Data Exfiltration/Impact
- **Details:** The malware intercepted SMS messages to capture verification codes. It initiated unauthorized premium subscriptions via carrier billing, resulting in charges such as 30.75 PLN (one-time) and 17 PLN (recurring weekly) per victim.
### Detection & Response
- **Detection:** CERT Polska identified two suspicious Facebook ads targeting Polish users.
- **Response:**
- 15 September 2026: Reported `Messenger Pro` to Google.
- Google removed the primary application from the Play Store.
- CERT Polska conducted infrastructure mapping, identifying 1,235 related ads and 17 malicious packages.
## Attack Methodology
- **Initial Access:** Malvertising on Meta platforms leading to Google Play Store downloads.
- **Persistence:** App requests to be the "Default SMS Handler," allowing it to remain active and intercept communications.
- **Privilege Escalation:** Requests standard but sensitive Android permissions (SMS handling).
- **Defense Evasion:**
- Multi-stage loading: The base APK contains an encrypted DEX, which decrypts a second DEX, which then downloads the final payload.
- Geography Gating: The malware checks the Mobile Country Code (MCC). Polish users (MCC 260) were served specific fraud payloads.
- Remote Logic: Fraudulent tasking and JavaScript are hosted on C2 servers to keep malicious logic out of the initial Play Store submission.
- **Credential Access:** Interception of SMS-based One-Time Passwords (OTPs) for billing confirmation.
- **Collection:** Gathering device info (MCC, operator details) to select appropriate billing exploits.
- **Exfiltration:** Sending confirmation codes to C2 or premium short codes.
- **Impact:** Financial theft via automated subscription enrollment (Toll Fraud).
## Impact Assessment
- **Financial:** Direct unauthorized charges to user mobile bills (e.g., 30.75 PLN per instance).
- **Data Breach:** Interception of private SMS communications.
- **Operational:** Compromised integrity of mobile devices used for communication.
- **Reputational:** Erosion of trust in Meta’s advertising vetting and Google Play’s application review process.
## Indicators of Compromise
- **Network Indicators:**
- `incydent.cert.pl` (Reporting portal)
- C2 servers issuing `sms:` links to short codes: `92505`, `92512`, `92513`
- **File Indicators:**
- App Name: `Messenger Pro` (Developer: Noah Isaiah Shortland)
- App Name: `Phone Cleaner Master`
- Package logic: `message.owyo`
- **Behavioral Indicators:**
- Application requesting "Default SMS Handler" status without legitimate need.
- Hidden background browser activity directed at billing pages (e.g., All4You, Teleaudio).
## Response Actions
- **Containment:** Google removed 17 identified malicious applications from the Play Store.
- **Eradication:** CERT Polska mapped the infrastructure (C2 and ad profiles) to facilitate broader takedowns.
- **Recovery:** Users must manually uninstall the applications as store removal does not delete existing installations.
## Lessons Learned
- **Cross-Platform Exploitation:** Attackers successfully combined the "reach" of Meta ads with the "trust" of Google Play to bypass user skepticism.
- **Payload Delay:** Static analysis of store-submitted APKs is insufficient when malicious logic is fetched dynamically via multi-stage loaders.
- **Regulatory Monitoring:** The use of the UKE Rejestr Premium (Polish Premium Register) was vital in identifying the specific financial channels used by the attackers.
## Recommendations
- **Users:**
- Never grant "Default SMS" permissions to utility apps (cleaners, PDF viewers).
- Review mobile bills for unauthorized "Premium Rate" charges.
- Disable premium SMS/carrier billing at the operator level if not needed.
- **Platforms:**
- Improve cross-platform threat intelligence sharing between ad networks and app stores.
- Enhance behavioral analysis for apps that download and execute remote DEX files.