Affected Systems

Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master. Campaign uses multi-stage DEX loaders targeting Polish mobile country code (MCC 260) across Orange, T-Mobile, Play, and Polkomtel networks. Premium SMS short codes 92505, 92512, and 92513 used for billing fraud at 30.75 PLN per message.

Exploitation Status

Active exploitation confirmed. CERT Polska observed live command and control servers delivering premium SMS and carrier billing fraud payloads to Polish users as of September 14, 2026. Campaign actively running with 1,235 preserved advertisements across 74 profile names and 17 confirmed malicious applications on Google Play.

Business Impact

Polish organizations face direct financial loss through unauthorized mobile billing charges (30.75 PLN one-time or 17 PLN weekly subscriptions). Multi-stage obfuscation using encrypted DEX files and remote JavaScript complicates detection by mobile security tools. Campaign demonstrates sophisticated evasion: legitimate app covers (messenger, utility), country-specific routing, and remote payload delivery. Malware requests default SMS handler permissions, enabling silent interception of verification codes. No CVE assigned as this is a fraud campaign rather than software vulnerability. Affects enterprise BYOD and personal devices on Polish mobile networks.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Block Google Play package com.messages.sms.messenger.textmessage.owyo (Messenger Pro v9.0) and Phone Cleaner Master on all managed Android devices via EMM/MDM policies
  • Monitor mobile billing logs for charges to premium SMS short codes 92505, 92512, 92513 and carrier billing domain epayment.teleaudio.pl across Orange, T-Mobile, Play, and Polkomtel accounts
  • Review Meta Ad Library for active campaigns using profile names Britney Harris and Kenneth Williams; report Ad Library IDs 1101937705505412 and 4635863290017072 if still active
  • Deploy mobile threat defense solutions capable of detecting multi-stage DEX loading and encrypted payload reconstruction on Android endpoints
  • Educate Polish users on PDF expiration scams and verify all app installations originate from legitimate developer accounts, not social media advertisements

---

# Geopolitical Context

Geopolitical Context

This incident reflects the persistent challenge of platform-mediated fraud targeting European mobile subscribers through coordinated abuse of advertising and application distribution infrastructure. The operation demonstrates sophisticated technical layering—spanning Meta's advertising network, Google Play distribution, and premium SMS/carrier billing systems—to monetize unauthorized mobile charges. Poland's telecommunications market, with four major operators and regulatory oversight by UKE, provides a structured billing environment that threat actors can exploit through aggregation services registered in Malta and the Netherlands. The campaign's reliance on legitimate EU-based payment aggregators (GoMobee LTD, Telefuture Nederland B.V., RedLeads B.V.) highlights regulatory gaps in cross-border accountability for premium rate services. While no state-sponsored actor is implicated, the operation's scale—1,235 advertisements across 74 profiles promoting 17 applications—suggests a financially motivated group with operational sophistication and knowledge of Polish mobile billing infrastructure.

State Actor Alignment

No state actor attribution is indicated in the available data. The campaign appears consistent with financially motivated cybercrime targeting consumer mobile billing systems. The use of Maltese and Dutch-registered premium SMS aggregators reflects commercial payment infrastructure rather than state-aligned operations. Polish national CERT (CERT Polska) detection and public disclosure aligns with standard EU member state cyber defense posture and consumer protection mandates under telecommunications regulation.

Business Impacty pro region

The incident underscores vulnerabilities in the European digital services ecosystem where advertising platforms, application stores, and telecommunications billing systems intersect. Poland's experience may reflect broader exposure across Central and Eastern European markets with similar premium SMS regulatory frameworks and mobile penetration rates. The campaign's technical architecture—country-specific payload routing based on mobile country codes—suggests adaptability to multiple jurisdictions. EU regulatory mechanisms, including the Digital Services Act's provisions on advertising transparency and the revised Payment Services Directive, may face implementation challenges in preventing such multi-platform fraud. The involvement of aggregators registered in Malta and the Netherlands raises questions about supervisory coordination among EU financial and telecommunications regulators. Other member states with comparable premium rate number registries and carrier billing adoption may face similar threats if detection capabilities lag behind the operational tempo of such campaigns.

Forecast

If platform providers do not enhance pre-publication vetting of applications exhibiting multi-stage code loading and encrypted payload delivery, similar toll fraud operations are likely to persist across European markets with active premium SMS infrastructure. Should Polish regulatory authorities (UKE) impose stricter verification requirements on premium rate aggregators or mandate real-time fraud detection by mobile operators, the campaign's monetization pathway may shift toward alternative billing mechanisms or jurisdictions with lighter oversight. If Meta and Google implement coordinated takedown protocols linking advertising accounts to malicious application packages, the operational cost for threat actors may increase, potentially reducing campaign scale. Absent such coordination, the demonstrated return on investment—evidenced by 1,235 advertisements and 17 applications—suggests continued or expanded targeting of Polish and neighboring markets. If other EU member states adopt CERT Polska's investigative methodology, similar campaigns may be uncovered in markets where national CERTs have not yet prioritized mobile billing fraud analysis.