CERT Polska: Meta ads led to 17 malicious apps
Fake warnings on Facebook redirected users to Google’s official store. Programs installed there could quietly charge the phone bill.
In September, CERT Polska described a campaign in which 852 ads on Meta platforms directed users to 17 malicious apps on Google Play. The ads were published under 60 profile names. The apps were linked by shared code or infrastructure. In total, the team secured 1,235 ads. Details are included in the CERT Polska analysis (opens in a new tab).
The analysis began with two ads targeted at Polish Facebook users. They warned about the supposed expiration of an app for handling PDF files. After clicking, however, they led to Messenger Pro, which had nothing to do with PDF files. The other apps posed as, among other things, messengers and simple utility tools.
Messenger Pro did in fact work as a messenger. Set as the default messaging app, it gained access to SMS messages. The malicious code used this access to order paid services in two ways. The first was Premium SMS, meaning messages with an extra charge. In one of the described cases, one SMS cost PLN 30.75. The second was Direct Carrier Billing, meaning a payment added to the operator’s bill or taken from the balance. In one case, the service cost PLN 17 every seven days.
In the more advanced variant, the app could identify the operator on its own and open the payment page in the background. It could also enter the phone number, intercept the verification code from the SMS and confirm the purchase, while the user saw neither the payment page nor the message with the code.
Kamil Sadkowski, a cyberthreat analyst at ESET, noted in a comment cited by ITwiz that the app’s permissions matched its declared function:
That is why it is worth looking not only at a single permission, but also at the whole story: why we are installing the app, how we got to it and whether we were actually looking for it ourselves
Google removed the reported apps from the store, and Meta blocked the indicated ads. However, programs installed earlier still remain on phones. It is recommended to check the list of apps and their permissions, and to review the bill for unknown charges. It is also possible to block Premium Rate services and Direct Carrier Billing payments with the operator.
This is not the first such case on Google Play. In May 2026, ESET detected 28 fraudulent apps from the CallPhantom family there, downloaded more than 7.3 million times. Earlier, it described 18 SpyLoan apps that impersonated loan programs and had more than 12 million downloads in total.
The same mechanism may also affect work Android phones. For company numbers, the subscriber, usually the company, decides whether to block paid services with the operator.