Large scale campaigns use fake app store pages to direct users to unlicensed operators and casinos.
NordVPN’s Threat Intelligence team has revealed a large-scale criminal network impersonating over 400 well-known brands to trick users into visiting unlicensed online gambling sites through paid social media ads.
The campaign, tracked as “pwa_betterlinks”, uses Instagram and Facebook ads, ostensibly featuring brands like Kalshi, Disney+, Google Authenticator, and Duolingo – as well as several national lotteries.
The infrastructure seems to operate as a commercial affiliate platform, with tools marketed with the Betterlinks platform, used by hundreds of affiliate accounts in order to drive traffic to unlicensed gambling operators.
Users who click into the ads are then redirected to a fake Google Play store page, and are then taken to an unlicensed online casino.
Instead of a genuine Play Store app, users are encouraged to install a Progressive Web App (PWA), which automatically puts a shortcut on their device to subscribe them to push notifications that promote gambling offers from the unlicensed operators.
Marijus Briedis, chief technology officer at NordVPN, said: “What we’re looking at is essentially trust laundering. Criminals take the credibility that legitimate companies have spent years building and redirect it toward their own ends. By the time a victim realises something is wrong, they’ve already deposited money into a casino they’ve never heard of.”
According to NordVPN, cloaking technology is used to evade moderation systems, with decoy pages deployed to ad reviewers, while redirecting users to gambling sites.
More than 7,200 instances were found by its researchers in which casino pages were delivered to users, as well as over 3,100 decoy pages shown to automated checkers.
The cybersecurity firm has advised users to always verify app installations open the genuine Google Play of Apple App stores, check website addresses before downloading software and review browser notification permissions regulatly.
The warning comes as social media sites, particularly Facebook and Instagram, have come under increased scrutiny for enabling unlicensed operators to advertise. Dutch trade bodies found an estimated 15,114 illegal gambling ads on Meta’s platforms in the Netherlands in March along this year.
The social media giant has reportedly generated around $16bn, or 10% of its 2024 revenue, from scam ads, banned goods, and illegal online gambling promotion.
