Cybersecurity researchers at NordVPN ventured into the internet's back alleys and, eyes wide with discovery, reported to the world that – brace yourselves – there's a scheme funneling traffic to online casinos through fake app store pages and PWAs. For anyone who's been marinating in affiliate traffic for the last six years or so, this lands somewhere around "water is wet." But since the report's out, let's break down what they dug up.
The Big Discovery
NordVPN analysts uncovered a large network using fake accounts impersonating more than 400 well-known brands to funnel users toward unlicensed gambling sites via paid ads on Instagram and Facebook. The campaign, tagged "pwa_betterlinks," reportedly runs on tooling sold through the Betterlinks platform and has spread across hundreds of affiliate accounts.
Brands caught up in the creatives include Kalshi, Disney+, Google Authenticator, Duolingo, and several national lotteries. Nothing personal – someone else's brand equity just converts better than your own.
How the Funnel Works (classic stuff, but let's put it on record):
- User clicks the ad and lands on a fake Google Play page;
- instead of a real app, they're prompted to install a PWA;
- the PWA quietly drops a shortcut on the device and enrolls the user in push notifications advertising casino offers;
- from there, it's straight into the unlicensed operator's funnel.
NordVPN's CTO Marijus Briedis called it "trust laundering" – criminals, he said, are hijacking reputations that legitimate brands spent years building, and victims only realize something's off after they've already deposited money into a casino they've never heard of.
On the Cloaking – NordVPN also discovered fire here: decoy pages get served to ad platform moderators while real users get routed to gambling sites. Researchers logged over 7,200 instances where users were shown casino pages, plus more than 3,100 "clean" fake pages served specifically to automated review systems.
NordVPN's advice to users: verify apps are legitimate, only install software from the real Google Play and App Store, check website URLs before downloading anything, and periodically review browser notification permissions. Also, frankly, not exactly a revelation.
Context
The report lands amid growing scrutiny of Meta over unlicensed gambling ads running on Facebook and Instagram. In March, Dutch industry bodies found roughly 15,114 illegal gambling ads live on Meta's platforms in the Netherlands. And by some estimates, Meta itself pulled in around $16 billion – roughly 10% of its total 2024 revenue – from fraudulent ads, banned goods, and the promotion of online gambling.
Bottom line: PWA-based cloaking for gambling offers isn't news to the industry – it's a working tool people have been running for years. But every time some cybersecurity outfit "discovers" it all over again, the industry just quietly smirks and keeps the traffic flowing.
