Cybersecurity experts warn of mobile scams via Google Play and system ads

Cybersecurity experts from CERT Polska and ESET have identified new fraudulent schemes targeting mobile users through malicious applications and system-level advertisements.

In one campaign, 852 advertisements on Meta platforms directed users to 17 malicious applications available on the official Google Play store. These apps, such as ‘Messenger Pro’, exploit user trust in official platforms to activate unauthorized SMS Premium services and Direct Carrier Billing. Once installed, the hidden code can intercept verification codes and add unauthorized charges directly to the user's phone bill.

Additionally, criminals are exploiting built-in advertising modules in smartphone operating systems, particularly on brands like Xiaomi, Oppo, and Realme. Fraudsters generate fake system notifications that mimic legitimate alerts from shopping platforms or loyalty programs. While real notifications trigger installed apps, these manipulated ads redirect users to external websites designed to steal login credentials, credit card numbers, or trick victims into paid SMS subscriptions. To mitigate risks on Xiaomi devices, experts recommend disabling the ‘msa’ (MIUI System Ads) service in the authorization settings.