When a Certificate Becomes a Clue: Infrastructure Linking in the Toll Fraud Investigation

Investigations of large mobile campaigns often depend on malware similarity. CERT Polska's September 23, 2026 report demonstrates a different approach: linking applications through registration records, DNS structure, object naming, code construction and a reused TLS certificate. The report carefully distinguishes between assertion and inference.

The investigation examined 17 applications and categorized evidence tiers. Six applications contained toll fraud components or direct payload links, while eleven more held malicious loaders connected to the same operation through ad destinations, hidden Android components, activation logic and infrastructure. However, the final fraud modules were not recovered in these applications.

A third tier involved 98 ads for Quick Show and BlushToon, promoted by profiles that also advertised confirmed campaign software. However, the recovered APKs were comic readers with different code and infrastructure, indicating advertiser account reuse rather than operational participation. Several connection types appeared repeatedly in the analysis, such as registration timing, shared WHOIS field hashes, object naming, code correspondence, shared C2 configuration, and a reused certificate.

Certificate reuse is particularly noteworthy, as it indicates shared infrastructure management, even though it does not prove control over all historical servers. The reused certificate was observed on five distinct addresses, suggesting dedicated infrastructure rather than shared hosting. This method of linking by infrastructure, rather than payload, is valuable for detecting variants that alter their final module, and it persists across code changes.

However, each link requires its own confidence statement, and the report maintains the qualification of the reused-certificate claim.