CERT Polska disrupted an Android toll-fraud campaign that used paid Meta adverts to direct Polish users to malicious apps on Google Play. The apps covertly subscribed victims to premium services, making unauthorised charges through premium-rate texts or recurring carrier billing, highlighting how trusted advertising and app platforms can be abused together.

Researchers linked 852 of 1,235 Meta adverts to 17 apps, six of which contained confirmed toll-fraud components. Some premium SMS services charged 30.75 PLN (£6.22) per message, while another carrier-billing scheme charged 17 PLN (£3.44) every seven days; the total number of victims and losses is unknown. Google removed the reported apps and Meta removed the adverts, but CERT said existing installations and active command-and-control systems remained a risk, with new packages appearing after the takedowns.