Facebook ads funnelled Polish Android users into premium-SMS and carrier-billing fraud via 17 Google Play apps
CERT Polska linked 852 Facebook ads to 17 Google Play apps that secretly ran premium SMS and carrier-billing fraud on Polish phones. Google removed the apps and Meta the reported ads, but installed copies and servers stayed active. Remove any such apps and check phone bills.
If you installed a messaging or utility app from a Facebook ad, such as Messenger Pro, uninstall it and check your phone bill for unexpected premium SMS or subscription charges. Ask your mobile carrier to block premium SMS and third-party billing, and to dispute any charges.
What’s happening
CERT Polska, Poland's national cyber response team, traced a fraud operation that used Facebook ads to push Android apps from Google Play. The ads carried a fake warning that a PDF app had expired. Of 1,235 preserved Meta ads, 852 were linked to 17 apps, mostly messaging and utility apps such as Messenger Pro and Phone Cleaner Master. Six apps exposed fraud components or direct payload links, and 11 held related loaders whose final fraud code was not recovered. The apps checked the phone's SIM country, and Poland was on the allowed list. Recovered payloads sent premium SMS to short codes 92505, 92512 and 92513, at 30.75 PLN a message, and ran hidden browser sessions that signed users up to carrier billing, including one charge of 17 PLN every seven days. Google removed all the identified apps and Meta removed the ads CERT Polska reported. The operation was not ended: new app packages appeared, the control servers kept running, and installed copies still contacted them. No operator has been named. No refunds or charges are reported.
- What
- Scam
- Affects
- Android phones in Poland with apps installed from Google Play after Facebook ads
- Affected
- 17 Google Play apps linked to the operation, including Messenger Pro (com.messages.sms.messenger.textmessage.owyo), Max Messenger, Text Chat, Phone Cleaner Master, PDF Scanner Art and Go Cleaner Pro
Android phones with a Polish SIM (country code 260) - Fixed in
- Nothing to patch
- Since
- 23 Sept 2026
- Closed
- 25 Sept 2026
Timeline
- UpdateNothing to patch
EFRI reported that the operation was not shut down: new app packages kept appearing, the control servers were still running, and installed copies still contacted them. It noted the European Commission had published no preliminary findings on deceptive advertising by Meta.
- Made publicNothing to patch
CERT Polska published its analysis. Six apps exposed fraud components or payload links and 11 held related loaders. The payloads sent premium SMS to three short codes at 30.75 PLN a message and ran hidden carrier-billing sessions. Meta removed the ads CERT Polska reported.
- UpdateNothing to patch
Google removed the Messenger Pro app, which CERT Polska used as its technical baseline. CERT Polska reported the other identified apps, and Google later removed all of them.
- Made publicNothing to patch
CERT Polska began its investigation after finding two Facebook ads that falsely warned a PDF app had expired. It went on to preserve 1,235 Meta ads and link 852 of them to 17 Google Play apps.
Sources
- Inside a multi stage toll fraud operation targeting PolandCERT Polska · 23 Sept 2026
- From two Facebook ads to 852: CERT Polska maps a new fraud infrastructure on MetaEFRI · 25 Sept 2026