Inside a multi stage toll fraud operation targeting Poland

CERT Polska discovered Meta advertisements funneling Polish users to malicious Google Play apps (notably "Messenger Pro") that implement a multi‑stage encrypted loader and remotely controlled payloads to automate premium SMS and direct carrier billing (toll fraud). The investigation linked 852 adverts under 60 profile names to 17 Google Play applications, recovered encrypted DEX stages and payloads, observed live C2 tasking against MCC 260 (Poland) including short codes 92505/92512/92513 and Teleaudio DCB flows, and produced extensive IOCs (packages, SHA‑256s, domains, OSS objects, and C2 IPs); store listings and ads were reported and removed but infrastructure and installed copies remained active.