CERT Polska exposes Meta ad fraud targeting Android users

CERT Polska has uncovered a large-scale toll fraud operation targeting Android users in Poland through paid Meta advertisements. The investigation identified 1,235 Meta ads, with 852 promotions linking users to 17 malicious applications on the Google Play Store.

The fraudulent scheme utilized deceptive advertisements, such as false warnings that a user’s PDF application had expired, to direct victims toward apps like ‘Messenger Pro’. Once installed, these apps could gain permission to manage SMS traffic, allowing them to enroll users in premium-rate SMS services or recurring carrier billing subscriptions without consent.

In one observed method, the malware sent keywords to premium short codes, charging users approximately 30.75 PLN per message. Another route involved recurring charges of 17 PLN every seven days. Following the discovery, both Google and Meta removed the implicated advertisements and applications from their platforms. Experts advise users to immediately delete any suspicious applications from their devices.