# Polish toll fraud operation abuses Meta ads, Google Play apps

Published: 2026-09-23 · Severity: routine · Sectors: telecommunications
Canonical: https://vorant.io/reports/3ca7e799-4bd8-580a-b478-0bf35e93f47f/polish-toll-fraud-operation-abuses-meta-ads-google-play-apps

> Multi-stage Android malware disguised as messaging apps targets Polish users with toll fraud via carrier billing and premium SMS.

CERT Polska discovered a coordinated toll fraud operation targeting Polish users through 1,235 Meta advertisements across 74 profiles promoting 17 malicious Google Play applications between July and September 2026. The malware used legitimate-looking messenger and utility app covers to solicit SMS and default SMS handler permissions, then deployed encrypted multi-stage payloads that enrolled subscribers in paid services without consent. The attack chain consisted of four execution layers: a base APK loader, a country policy gate that verified MCC 260 for Poland, a payload router that selected between targeted and default fraud modules, and finally the toll fraud payload itself. The operation exploited both premium SMS (sending keywords to short codes 92505, 92512, 92513 registered in Polish regulator UKE's database) and direct carrier billing through hidden WebView pages on operator billing domains. The C2 infrastructure, hosted on Alibaba Cloud and Amazon-registered domains, remained operational during analysis and continued accepting registrations and issuing fraud jobs even after Google removed the applications. Six applications recovered full toll fraud components; eleven others contained malicious loaders with unrecovered payloads. Shared WHOIS registrant data, certificate reuse (ablefee.wiki Let's Encrypt certificate SHA-256 5848152508acc864869500c0dfff20723a087019eb717131dc6d7df51fbd75e6 across six IP addresses), and identical loader code linked the entire operation.

## Mentioned in this report

- Malware: AqMu, Colorful Message, Cool Wallpaper, Max Messenger, Messenger Pro, PDF Scanner Pro, Phone Cleaner Master, Quick Chat Message, Short Messages, Text Messages

4 detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://cert.pl/en/posts/2026/09/tollfraud-analysis

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3ca7e799-4bd8-580a-b478-0bf35e93f47f/polish-toll-fraud-operation-abuses-meta-ads-google-play-apps.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup