Polish toll fraud operation abuses Meta ads, Google Play apps
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multi-stage Android malware disguised as messaging apps targets Polish users with toll fraud via carrier billing and premium SMS.
CERT Polska discovered a coordinated toll fraud operation targeting Polish users through 1,235 Meta advertisements across 74 profiles promoting 17 malicious Google Play applications between July and September 2026. The malware used legitimate-looking messenger and utility app covers to solicit SMS and default SMS handler permissions, then deployed encrypted multi-stage payloads that enrolled subscribers in paid services without consent. The attack chain consisted of four execution layers: a base APK loader, a country policy gate that verified MCC 260 for Poland, a payload router that selected between targeted and default fraud modules, and finally the toll fraud payload itself. The operation exploited both premium SMS (sending keywords to short codes 92505, 92512, 92513 registered in Polish regulator UKE's database) and direct carrier billing through hidden WebView pages on operator billing domains. The C2 infrastructure, hosted on Alibaba Cloud and Amazon-registered domains, remained operational during analysis and continued accepting registrations and issuing fraud jobs even after Google removed the applications. Six applications recovered full toll fraud components; eleven others contained malicious loaders with unrecovered payloads. Shared WHOIS registrant data, certificate reuse (ablefee.wiki Let's Encrypt certificate SHA-256 5848152508acc864869500c0dfff20723a087019eb717131dc6d7df51fbd75e6 across six IP addresses), and identical loader code linked the entire operation.
Mentioned in this report
Detection guidance
4 detections for this report are in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://cert.pl/en/posts/2026/09/tollfraud-analysis
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs