Europeans Targeted With 'Monitor Your Blood Sugar' Ads Reaching 28,000 Accounts in France, Germany, Ireland and the Netherlands

Threat Research Team | 29 October 2026

Europe is the target. A Facebook Page called "Blood Sugar & Blood Pressure" is running about 51 active ads in the European Union promising phone-based health checks. Its lead ad alone has reached an estimated 28,658 accounts, most of them in France (4,294), Germany (3,687), Ireland (2,440) and the Netherlands (1,967), according to Meta's EU transparency data.

An ad in your Facebook or Instagram feed says "Monitor your blood sugar" and shows a video warning that "90% of people have kidney stones and you might be one of them". Tap "Install now" and you land on a free Google Play app that, in its own small print, says it "does not measure blood pressure, blood sugar, heart rate, or any medical data directly".

The Threat Research Team traced that ad back to a single Facebook Page, "Blood Sugar & Blood Pressure". The Page is running about 51 active ads in the EU for five apps from five differently named developers in Hong Kong, Guangzhou and Pakistan. The apps share backend servers and DNS set-ups. Users report wrong readings, fake features, sexual ads and, in two cases, burning fingers. The apps' Play Store privacy labels say they collect no data, yet they contain 8 to 26 advertising and tracking SDKs.

This article walks through the scheme step by step, in the order a user meets it, with a screenshot at each step showing what to look for. None of the five app samples we checked raised any antivirus detections; the tracker and antivirus results are for older app builds than those now on Google Play. The problem is deceptive health advertising, misleading claims and ad-heavy monetisation.

Key findings

Step 1: The ad in your feed

The lead ad, Library ID 923633833762665, has been running since 26 March 2026 on Facebook, Instagram, Audience Network, Messenger and Threads. The caption reads "Monitor your blood sugar" and the button says "Install now". The video opens with a fear hook, "90% of people have kidney stones and you might be one of them", over a medical animation.

The video is branded "BPM+ | Health Recorder", the name of a different app (com.heart.bpm, 1M+ installs) published by WellLog's developer, yet the ad's advertiser disclaimer names Beatly. Meta's EU transparency panel puts its reach at 28,658 accounts, led by France (4,294), Germany (3,687), Ireland (2,440) and the Netherlands (1,967).

Figure 1. The lead ad. Look for: a health-measurement promise ("Monitor your blood sugar"), a scare statistic, and an app brand ("BPM+") that does not match the app the ad is for.

Step 2: Check who is behind it in the Ad Library

Anyone can look up an advertiser in Meta's free Ad Library (facebook.com/ads/library) by tapping "Why am I seeing this ad?" or searching the Page name. This Page has a generic name, "Blood Sugar & Blood Pressure", and the category "Software". It has 151 followers but runs about 51 active ads.

Its transparency panel shows the Page was created on 28 October 2025, has never been renamed, and is managed by people in Hong Kong (1), Thailand (1) and the United States. No organisation is listed as managing it.

Figure 2. The Page in Meta's Ad Library. Look for: a generic, keyword-style Page name and dozens of active ads.

Figure 3. Page transparency. Look for: very few followers compared with the ad volume, a recent creation date, and managers spread across several countries with no named organisation.

Step 3: The advertiser and payer panel

Open "See ad details" and scroll to the advertiser and payer section. For this ad, Meta's panel shows two entries. The upper disclaimer lists the website bluefocusgroup.com and names 蓝色光标（天津）移动互联科技有限公司 (BlueFocus Mobile, Tianjin) as both advertiser and payer. The "Current" entry names "Beatly" as both.

BlueFocus Mobile is a subsidiary of BlueFocus Communication Group (Shenzhen-listed, 300058) through Domob. The group is one of China's largest overseas media buyers, and Meta lists BlueFocus's BlueMedia among its official China resellers. The entity has since been renamed 蓝色光标（武汉）移动互联科技有限公司. Its appearance here most likely reflects reseller billing on behalf of a client, not ownership of the app. We make no allegation of wrongdoing by BlueFocus.

It should also not be confused with the Vietnam-based "Bluefocus Agency" that Reuters described in December 2025 as a second-tier reseller of GatherOne.

Figure 4. Advertiser and payer panel for ad 923633833762665. Look for: a payer that is an agency or reseller rather than the app developer, and a "Current" advertiser name ("Beatly") that differs from the Page name.

Step 4: One Page, many unrelated apps

A genuine health company advertises its own product. This Page promotes five apps from five developer names: three health trackers (Beatly, VitalBeat, WellLog), a video downloader (Video Haven) and a file-recovery tool (AllBack).

On 8 and 9 October 2026, the same "health" Page started running "Watch full episodes for free" and "ALL FREE" ads with racy video thumbnails, pointing to Video Haven and AllBack. Neither app streams episodes. Video Haven's own listing says it "does not host or provide video content". Meta has marked at least one of these ads as "not active for some audiences because it did not meet certain requirements".

Figure 5. The same Page's ad list. Look for: a "health" advertiser suddenly promoting free-episode bait, and Meta's own warning that the ad did not meet its requirements.

Step 5: The Play listing contradicts the ad

The lead ad goes to Beatly: Blood Pressure & Sugar (com.heart.beatly.health.tracker), which has 5M+ installs, a 4.4-star rating and an "Everyone" content rating. Its screenshots promise "Blood Sugar Data Records" next to a stock photo of a doctor. The listing is marked "Contains ads" and "In-app purchases".

Further down, the description says: "Beatly does not measure blood pressure, blood sugar, heart rate, or any medical data directly ... It is not a medical device." VitalBeat and WellLog use similar disclaimers ("not a substitute for professional medical advice"). The listing for BPM+, the app named in the video, says "BPM+ does not measure health data".

Figure 6. Beatly on Google Play. Look for: health-measurement screenshots at the top and, in the description, a disclaimer saying the app measures nothing.

No smartphone camera, flash or screen can measure blood glucose. The US FDA has warned against using even smartwatches or smart rings that claim to measure glucose without piercing the skin. Camera-based blood-pressure readings are also unreliable: a 2016 JAMA Internal Medicine study found that one such app missed about 78% of hypertensive readings.

Step 6: The developer section

Scroll to "About the developer" at the bottom of each listing. The five apps use five company names, but the details overlap:

• Beatly: Hong Kong Ark Mobile Technology Ltd. Support contact fifavpn.app@gmail.com, a Gmail address named after a VPN product. Listed office: Suite B35, United Centre, Hong Kong.
• VitalBeat: CODEJOY TECHNOLOGY LIMITED, admin@codejoys.net. Listed office: Suite B35 in the same building, United Centre.
• WellLog: You Only Live Once Studio, registered as 广州优路网络科技有限公司 (Guangzhou), donghang.ccdmobile@gmail.com.
• Video Haven: SS ORGANIC (SMC-PRIVATE) LTD, Okara, Pakistan, ssorganicprivatelimited@gmail.com. Released 14 Aug 2026.
• AllBack: APPMOBISELL (PRIVATE) LTD, Islamabad, Pakistan, rashidafifa27@gmail.com. Released 10 Sep 2026.

Figure 7. "About the developer" for the five apps. Look for: free Gmail contacts on "health" apps, the same office unit (B35, United Centre) behind two supposedly separate companies, and brand-new publishers.

Ark Mobile Tech publishes 11 apps, including VPNs and a heart-rate app, CardioLens. CodeJoy publishes 10, including a short-drama app. YOLO Studio publishes 7, including BPM+. A health-app maker whose portfolio also includes VPNs, scanners and drama apps is typically running a broad ad-revenue business, not specialising in health.

Step 7: What users report

We collected 907 unique one- and two-star reviews across 11 locales. Reviewer names are blurred in the figures. The same problems recur in all three health apps:

• Wrong or fixed readings. "Every bp reading has been exactly the same, 100/45 and pulse is 75 ... When I take it with my cuff, it changes day to day as it should." (Beatly, 20 Mar 2026). "...210/165 where my machine said 172/128." (VitalBeat, 4 Jan 2026; the developer replied on 6 Mar 2026: "We're working to ensure similar issues won't happen again.")
• Features the ads promised but the apps do not have. "Not as described. The video showes an area to test Blood Sugar. WHERE?" (Beatly, 19 Jun 2026). "Ads are a lie. It only measures heart rate!" (Beatly, 25 Oct 2026). "ad said it face scans for liver problems. nope. straight up lie" (WellLog, 29 Sep 2026). "detect pregnancy based on my fingerprint BUT ITS A LIE!!" (VitalBeat, 21 Nov 2025). "I was looking for the HIV feature like stated in the ad and there was none" (WellLog, 5 Jul 2026).
• Dangerous false results. A Mexican user wrote that WellLog "says it detects people with HIV" and told a healthy man he had HIV (19 Jun 2026, translated from Spanish). A diabetic user wrote of Beatly: "im diabetic, and this is not accurate at all.." (9 May 2026).
• Sexual and intrusive ads. "5 sexual ads within 30 seconds of opening is not acceptable or appropriate" (VitalBeat, 16 Oct 2025). Another user warned that "ads not allowing you blood pressure reading to finish... you could die using this app" (VitalBeat, 5 Oct 2025). All three apps are rated "Everyone".
• Physical discomfort. "it burns my hands" (WellLog, 15 Oct 2026). A Spanish-language review says the app burned the user's finger and "took off the first layer of skin" (WellLog, 27 Mar 2026, translated). Camera-based "measurements" usually keep the flash LED on against the fingertip, which can get hot.

Figure 8. Reviews reporting inaccurate readings. Look for: the same reading every time, and readings far from a real cuff.

Figure 9. Reviews reporting sexual ads and burns. Look for: complaints about adult ads in an app rated "Everyone", and heat from the flash.

Step 8: "No data collected", yet full of trackers

All five apps declare "No data collected" and "No data shared" in their Play Store Data safety sections. Exodus Privacy's analysis of the published APKs shows otherwise:

Ad and attribution SDKs such as these normally process an advertising ID and device data, so the "No data collected" labels are very likely inaccurate. Exodus has no reports for Video Haven or AllBack.

Figure 10. Play Store privacy labels against the trackers Exodus Privacy found. Look for: "No data collected" on an ad-supported app.

Step 9: Behind the scenes, one shared infrastructure

The five developer names look independent, but their servers do not:

• Same backend. Each app's API host (beatly.fifavnet.net, vitalbeat.codejoys.net, well.yolonet.io, videohaven.ssorganic.uk, allback.appmobisell.com) runs the same Python (uvicorn) stack behind dedicated Google Cloud load balancers. The x-request-id response headers reveal a shared pool of 8 backend node IDs, and node 98ba51296968e932 answered for all five hosts.
• Same DNS. fifavnet.net (Ark) and codejoys.net (CodeJoy) use an identical set of four Name.com nameservers, and yolonet.io (YOLO) shares two of them plus the same website template. ssorganic.uk and appmobisell.com, the two Pakistani publishers, share a Cloudflare nameserver pair, return the same one-word root page ("hi"), and were registered three weeks apart (14 Aug and 8 Sep 2026).
• Same code habits. All five APKs we could analyse (Beatly, VitalBeat, WellLog and two Ark VPN apps) bundle the same utility library, and storage-key names repeat across WellLog and Ark's VPN apps. On their own these are weak signals, but they fit the pattern above.
• Throwaway signing. Each APK is signed with its own self-signed certificate (one VPN simply uses "CN=demo1"), so certificates do not link the apps. The servers do.

Figure 11. How the Page, the five apps and their infrastructure connect. Shared backend node IDs and nameservers indicate a single operator or a shared vendor behind the five developer names.

Step 10: How to spot it

Before you install a health app from an ad, check:

1. The promise. Does it claim your phone can measure blood sugar, blood pressure, pregnancy, HIV, liver or kidney health? Phones cannot do this.

2. The fear hook. Scare statistics ("90% of people have kidney stones") are a sales tactic, not medical advice.

3. The brand. Does the name in the video match the app the ad links to?

4. The Page. In the Ad Library: few followers, many ads, a recent creation date, managers in several countries.

5. The payer. An agency or reseller named as payer, with an unrelated "current" advertiser.

6. The portfolio. One "health" Page also pushing video downloaders or "free episodes".

7. The small print. Read the description to the end. "Not a medical device" or "does not measure" means exactly that.

8. The developer. A Gmail address, a shared office unit, or a publisher with VPN and drama apps.

9. The reviews. Filter by one star and look for "same reading", "fake", "ads". 10. The privacy label. "No data collected" on an app full of ads is a red flag.

If you need to check your blood sugar or blood pressure, use a certified glucometer or cuff and talk to a doctor.

Global Issue

Regulators have already acted on this kind of advertising. On 17 June 2026, the UK Advertising Standards Authority upheld complaints against three Hong Kong-linked blood-pressure apps after the MHRA advised that such apps are medical devices. In 2016 the US FTC settled with the makers of the Instant Blood Pressure app over inaccurate readings. Australia's TGA publishes guidance for consumers on software-based medical devices. Google Play's Health Content and Services policy requires apps to avoid misleading health claims and to complete a Health apps declaration.

This network's ads were seen in the EU, but its apps are distributed worldwide. Ark's CardioLens heart-rate app has been listed by AppBrain among popular Health & Fitness apps in India (ranking not reconfirmed at publication). We found no specific public warning from India's CDSCO about camera-based blood-pressure or glucose apps. Software intended to measure physiological values can fall under the Medical Devices Rules, 2017.

The problem is wider than one Page. A keyword search for "blood sugar" in Meta's Ad Library for the Netherlands alone showed thousands of active ads when we checked in October 2026, many for supplements. The count changes daily.

What users should do

• Do not rely on any phone app for blood sugar, blood pressure or disease screening. Uninstall apps that claim to measure these.
• Report misleading ads on Facebook and Instagram (the three-dot menu, then "Report ad"), and report apps on Google Play ("Flag as inappropriate").
• Check and cancel any Google Play subscriptions you did not intend to start.
• In India, you can report fraud and deceptive online ads on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or by calling 1930.

What platforms and regulators can do

• Meta: review Page 862121593652863 and its ads for health-claim policy violations, and check other ads billed through the same reseller account for the same pattern.
• Google Play: review the five listings against the Health Content and Services policy, the Health apps declaration and Data safety accuracy. Also look at the shared-infrastructure links between the five developer accounts.
• Regulators: treat camera-based "measurement" claims as medical-device claims, as the UK has. Advertising-standards bodies and consumer-protection authorities, including in India, can act on the ad claims themselves.

Methodology

We reviewed the public Meta Ad Library entries for Page 862121593652863 and ad 923633833762665, including the EU transparency and advertiser/payer panels, in October 2026. We captured the five Google Play listings, their developer sections and Data safety sections. We collected and de-duplicated 907 one- and two-star reviews across 11 locales, and checked the quotes above word for word. Tracker data comes from Exodus Privacy reports; antivirus results come from existing VirusTotal reports (we uploaded nothing). Infrastructure links come from passive DNS, WHOIS and HTTP response headers of the apps' public API hosts. The BlueFocus corporate details come from public filings and company pages. The analysed APK builds are older than the current Play versions (for example Beatly 1.1.94 versus 1.2.30).

Indicators

Meta

Apps

Domains: fifavnet.net, codejoys.net, yolonet.io, ssorganic.uk, appmobisell.com (API hosts beatly.fifavnet.net, vitalbeat.codejoys.net, well.yolonet.io, videohaven.ssorganic.uk, allback.appmobisell.com).