Meta ads steered Polish Android users into a premium-rate billing trap

The Computer Emergency Response Team in Poland (CERT Polska) has dismantled a fraudulent Android campaign that utilized paid Meta ads to direct Polish users towards malicious applications on Google Play. Their research uncovered 1,235 Meta ads, 852 of which led to 17 targeted apps. Six of these apps directly facilitated toll fraud, while the remaining 11 contained malicious loaders.

Toll fraud involves malware secretly enrolling mobile users in paid services without their consent, often through premium-rate SMS messages or carrier billing. CERT Polska identified three active premium services, each charging between 17 and 31 PLN ($4.41-$7.97) per transaction. The operation involved a dual strategy, using both Facebook and TikTok platforms to distribute the malicious ads.

The research revealed that the malware, disguised as the Messenger Pro app, could bypass the device's security measures by reconstructing an encrypted DEX file at runtime. Once activated, the malware communicated with a command-and-control server to carry out the premium SMS or carrier billing tasks. Google removed the identified apps from Play Store, while Meta took down the fraudulent ads.

However, the takedowns did not halt the distribution, as new packages continued to emerge after Google's removals. Users who have installed any of the malicious apps are advised to remove them from their devices to prevent further charges appearing on their phone bills.