{"id":"poland-facebook-ads-android-toll-fraud-sep-2026","category":"scam","status":"closed","title":"Facebook ads funnelled Polish Android users into premium-SMS and carrier-billing fraud via 17 Google Play apps","tldr":"CERT Polska linked 852 Facebook ads to 17 Google Play apps that secretly ran premium SMS and carrier-billing fraud on Polish phones. Google removed the apps and Meta the reported ads, but installed copies and servers stayed active. Remove any such apps and check phone bills.","summary":"CERT Polska, Poland's national cyber response team, traced a fraud operation that used Facebook ads to push Android apps from Google Play. The ads carried a fake warning that a PDF app had expired. Of 1,235 preserved Meta ads, 852 were linked to 17 apps, mostly messaging and utility apps such as Messenger Pro and Phone Cleaner Master. Six apps exposed fraud components or direct payload links, and 11 held related loaders whose final fraud code was not recovered. The apps checked the phone's SIM country, and Poland was on the allowed list. Recovered payloads sent premium SMS to short codes 92505, 92512 and 92513, at 30.75 PLN a message, and ran hidden browser sessions that signed users up to carrier billing, including one charge of 17 PLN every seven days. Google removed all the identified apps and Meta removed the ads CERT Polska reported. The operation was not ended: new app packages appeared, the control servers kept running, and installed copies still contacted them. No operator has been named. No refunds or charges are reported.","action":"If you installed a messaging or utility app from a Facebook ad, such as Messenger Pro, uninstall it and check your phone bill for unexpected premium SMS or subscription charges. Ask your mobile carrier to block premium SMS and third-party billing, and to dispute any charges.","product":"Android phones in Poland with apps installed from Google Play after Facebook ads","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["scam","android","google-play","meta","facebook","malvertising","toll-fraud","poland","cert-polska"],"affected":["17 Google Play apps linked to the operation, including Messenger Pro (com.messages.sms.messenger.textmessage.owyo), Max Messenger, Text Chat, Phone Cleaner Master, PDF Scanner Art and Go Cleaner Pro","Android phones with a Polish SIM (country code 260)"],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Inside a multi stage toll fraud operation targeting Poland","url":"https://cert.pl/en/posts/2026/09/tollfraud-analysis/","by":"CERT Polska","date":"2026-09-23"},{"kind":"research","title":"From two Facebook ads to 852: CERT Polska maps a new fraud infrastructure on Meta","url":"https://efri.io/from-two-facebook-ads-to-852-cert-polska-maps-a-new-fraud-infrastructure-on-meta/","by":"EFRI","date":"2026-09-25"}],"started":"2026-09-23","closed":"2026-09-25","created":"2026-11-03T21:38:28.630Z","updated":"2026-11-03T21:38:28.630Z","cve_notes":[],"timeline":[{"at":"2026-09-25","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"EFRI reported that the operation was not shut down: new app packages kept appearing, the control servers were still running, and installed copies still contacted them. It noted the European Commission had published no preliminary findings on deceptive advertising by Meta.","url":"https://efri.io/from-two-facebook-ads-to-852-cert-polska-maps-a-new-fraud-infrastructure-on-meta/","by":"EFRI","patch":"na"},{"at":"2026-09-23","added":"2026-11-03T21:37:06.107Z","kind":"disclosed","text":"CERT Polska published its analysis. Six apps exposed fraud components or payload links and 11 held related loaders. The payloads sent premium SMS to three short codes at 30.75 PLN a message and ran hidden carrier-billing sessions. Meta removed the ads CERT Polska reported.","url":"https://cert.pl/en/posts/2026/09/tollfraud-analysis/","by":"CERT Polska","patch":"na"},{"at":"2026-09-15","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"Google removed the Messenger Pro app, which CERT Polska used as its technical baseline. CERT Polska reported the other identified apps, and Google later removed all of them.","url":"https://efri.io/from-two-facebook-ads-to-852-cert-polska-maps-a-new-fraud-infrastructure-on-meta/","by":"EFRI","patch":"na"},{"at":"2026-09-14","added":"2026-11-03T21:37:06.107Z","kind":"disclosed","text":"CERT Polska began its investigation after finding two Facebook ads that falsely warned a PDF app had expired. It went on to preserve 1,235 Meta ads and link 852 of them to 17 Google Play apps.","url":"https://cert.pl/en/posts/2026/09/tollfraud-analysis/","by":"CERT Polska","patch":"na"}],"url":"https://hard.fyi/live/poland-facebook-ads-android-toll-fraud-sep-2026/","json":"https://hard.fyi/api/live?id=poland-facebook-ads-android-toll-fraud-sep-2026"}