Inside a multi stage toll fraud operation targeting Poland

The report

CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852 to 17 applications through code or infrastructure, reconstructed the complete execution chain, and observed live premium SMS and carrier billing tasking.

Read the full analysis: Inside a multi stage toll fraud operation targeting Poland (cert.pl).

Indicators

Malware C

• api[.]appbhwljk[.]com
• auezon[.]com
• bcvsri[.]link
• dokersxxnv[.]click
• evabunt[.]link
• fdghsn[.]link
• fgsbns[.]link
• funtpjw[.]click
• fuzwek[.]click
• ghdnbv[.]link
• hsbdbv[.]link
• ksbxnc[.]link
• merfunk[.]click
• msg[.]fastcleaa[.]link
• piaagt[.]click
• sdbnxm[.]link
• swepqk[.]click
• tegonp[.]click
• tehsnb[.]link
• trixbn[.]link
• uhsbxh[.]link
• vamko[.]click
• x[.]euono[.]com
• yandeb[.]link

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#2). This page is generated from that record and the report’s own title and summary; nothing is rewritten.