Our friends at NordVPN’s Threat Intelligence team has just uncovered a criminal network running paid Facebook and Instagram ads that impersonate over 400 trusted brands — from Google Authenticator and Kalshi to national lotteries — to trick people into fake app installs that redirect them to unlicensed online casinos.
The operation is not the work of a lone scammer.
It is a rented criminal platform, actively running today, used by roughly a thousand affiliates across more than 250 teams. This large-scale criminal operation hijacks the logos and names of over 400 trusted brands to redirect unsuspecting people toward unregulated online gambling. The network — which NordVPN tracks as pwa_betterlinks — runs paid adverts on Facebook and Instagram impersonating household names including Google Authenticator, Kalshi, Disney+, Duolingo, Delta Air Lines, and national lotteries.
Victims who tap the ad are shown a fake Google Play Store page that is nearly impossible to distinguish from the real thing. One tap of “Install” later, they land on an unlicensed casino asking for a deposit. What a real, targeted person sees: The full fake Google Play page — here spoofing Crown Melbourne
“What we’re looking at is essentially trust laundering. Criminals take the credibility that legitimate companies have spent years building and redirect it toward their own ends. By the time a victim realizes something is wrong, they’ve already deposited money into a casino they’ve never heard of.” Marijus Briedis, chief technology officer at NordVPN.
The fake app store hiding inside a social media ad
Every victim’s journey starts with a paid ad on Facebook or Instagram. A real, purchased placement that carries the implicit legitimacy of a platform people use every day. Clicking it takes users to what appears to be a genuine Google Play Store listing, complete with the brand’s logo, a forged developer name, a 4.9-star rating, and thousands of fabricated reviews. The only visible tell is the web address in the browser bar — a random throwaway domain rather than play.google.com. Google Authenticator spoofed on playrosario[.]site (Google LLC · Tools)
The impersonated brands span casinos and national lotteries (Crown Melbourne, Holland Casino, EuroMillions), mainstream apps (Google Translate, Google Authenticator, YouTube Kids, Adobe Acrobat, Shazam), financial services (Capital One, Credit Karma, Kalshi), streaming (HBO Max, Disney+, Peacock), and travel (Delta, United, Airbnb).
The Install button that installs nothing
Tapping Install triggers a convincing fake progress bar. No app is downloaded. What actually happens is a shortcut — a Progressive Web App, or PWA — is silently added to the home screen under the impersonated brand’s name and icon. A PWA is not a real app. It is a website that looks like one, sitting on a phone’s home screen with zero app store vetting required. The criminal can spin up a new fake page as fast as they can register a domain. On the left PWA “Installation” on Android, on the right Official app installation. The process also silently signs the device up for push notifications, which fire gambling reminders directly to the lock screen and are deliberately difficult to disable. Even the back button is rigged. Instead of returning users to the previous page, it reroutes them to the casino offer.
A commercial product designed to evade detection
Before any real page is shown, every click passes through a cloaking layer that checks whether the visitor is a human or an automated scanner — including Facebook’s own ad review bots. Checkers are served a blank decoy page. Real users are served the fake casino funnel. Across NordVPN’s captured dataset, the casino page was served 7,261 times; the decoy was served to checkers 3,153 times. The people doing the checking never see what the actual targets see. The network is structured as a commercial product, not a one-off scam. At the top sits betterlinks[.]pro, a platform that markets itself openly as a “PWA constructor for affiliates” with built-in cloaking and Facebook optimization. Unlicensed casino registration with an offering of 150% up to €3,000/ $4,830 CAD + 150 FS dazard[.]com
In the middle sit roughly a thousand affiliate accounts across more than 250 teams who rent the kit and buy social media traffic to run campaigns. At the bottom are the unlicensed casinos and CPA networks that pay the affiliates a commission for every user who registers or deposits — with captured records linking the operation to the Makeberry Affiliates network and casinos.
How to stay safe?
Marijus Briedis advises anyone using social media to keep three things in mind: A real app install always opens the official store. If tapping “Install” in an ad opens a web page rather than the Google Play Store or Apple App Store, stop immediately. Check the address bar. A genuine Google Play listing lives at play.google.com. Any other web address showing a store-style page — no matter how accurate the branding — is a fake. Review your push notification permissions. Go to your phone’s settings and check which websites have permission to send you alerts. Revoke anything you don’t recognize.
Methodology
The investigation began by identifying a shared template fingerprint across a cluster of fake app-store pages, which NordVPN used to recover live instances of the operation at scale. From there, analysts mapped the full funnel logic through network traffic analysis and JavaScript deobfuscation, revealing the infrastructure connecting individual affiliate accounts to their campaigns, destination casinos, and real Facebook Business ad pixels. Domain registration records, hosting provider data, and code-level signals — including language markers in the push notification code — were used to support operator attribution. All indicators of compromise are analyzed in machine-readable format (STIX 2.1, 880 indicators). Conclusions are based on verified data, with the perimeter of the identified systems delimited with the maximum possible accuracy.
While generative AI transforms how Americans shop, it’s also quietly powering a counterfeit crisis now spiraling out of control. A groundbreaking new report from Red Points and OnePoll, The Counterfeit Buyer Teardown, reveals that AI is no longer just helping consumers find the best deals—it’s helping them find fakes. From influencer-driven “dupe culture” to hyper-realistic fake storefronts, the study exposes a booming underground economy that’s been supercharged by technology. With 28% of counterfeit buyers now using AI tools to seek out knock-offs, and fraudulent social media ads spiking 179% in just one year, the findings deliver a wake-up call for brands, regulators, and shoppers alike. Red Points execs are available to break down the data, discuss solutions, and explain why this rapidly evolving trend is both a technological and ethical crisis for the digital marketplace. Interest here as we hope?
AI Supercharging U.S.and Other E-Commerce Counterfeit Crisis
An explosive new report, “The Counterfeit Buyer Teardown, ” paints a concerning picture of a rapidly evolving and increasingly sophisticated counterfeit goods market, driven by a new factor: Artificial Intelligence. Forget the back alleys; findings from the research—conducted by market research firm OnePoll and AI company Red Points in February 2025—highlight that the future of fakes is digital, AI-assisted, and alarmingly mainstream.
The convergence of technology, social media, and shifting consumer mindsets is reshaping e-commerce—and not always for the better. As AI accelerates both the spread and appeal of counterfeit goods, the challenge is no longer just spotting fakes—it’s confronting a counterfeit economy that’s growing smarter, faster, and harder to contain.
“As counterfeiters adopt advanced tools like AI, the fight against fakes is becoming more complex and more urgent,” said Laura Urquizu, CEO & President of Red Points. “We’re now seeing AI shape both the threat and the solution. In 2024 alone, our firm detected 4.3 million counterfeit infringements online—an alarming 15% increase year-over-year.”
Alarming indeed. Here are 5 key revelations from the study.
1. AI is the New Enabler of Counterfeiting – A Two-Sided Threat:
The Counterfeiters’ Edge: AI is dramatically lowering the barrier to entry for bad actors. They can now mimic brand listings, and impersonate social media accounts with unprecedented ease and speed. They can also effortlessly create professional-looking fake websites—a situation that, according to Red Points’ data, is projected to surge 70% in 2025.This isn’t just about cheap knock-offs anymore; it’s about sophisticated deception at scale.
The Consumers’ Assistant: Shockingly, 28% of online shoppers who bought fake goods used AI tools to find them. This isn’t a fringe behavior; it’s a growing trend, especially among Gen X, suggesting consumers are actively leveraging AI in their pursuit of cheaper alternatives. This fundamentally shifts the narrative – it’s not just about being tricked; some are actively seeking fakes with AI’s help.
2. Accidental Counterfeiting is a Major Problem – Trust Signals are Being Hijacked:
1 in 4 luxury counterfeit purchases are unintentional. This shatters the perception that buyers knowingly seek out high-end fakes. Realistic pricing, secure payment promises, and active (but fake) social media presence are successfully deceiving consumers. AI-generated legitimacy cues are becoming indistinguishable from the real deal.
Brands are Paying the Price for These Mistakes: A staggering one in three shoppers stop buying from the genuine brand after an accidental counterfeit experience. This highlights the significant damage to brand loyalty and future sales, even when the brand isn’t directly selling the fake. High-trust categories like luxury and toys are particularly vulnerable.
3. The “Dupe Economy” is Real and Influencer-Driven:
Nearly a third (31%) of intentional counterfeit buyers were swayed by influencer promotions. Social media is driving the demand for “dupes” – budget-friendly replicas. Authenticity is taking a backseat to price and perceived identical appearance, especially among younger demographics.
This isn’t just about saving money; it’s a shift in consumer mindset. The report suggests a growing acceptance of fakes as clever alternatives, fueled by social validation and influencer endorsements.
4. Marketplaces Remain Key, But Social Media and Fake Websites are Surging:
Marketplaces (both US and China-based) are still the primary channels for counterfeit purchases. However, fake websites (accounting for 34% of unintentional purchases) and social media are rapidly gaining ground as sophisticated avenues for distribution, amplified by AI’s ability to create convincing facades.
Social media ads redirecting to infringing websites saw a massive 179% year-over-year growth. This highlights the increasing sophistication of counterfeiters in leveraging advertising platforms to drive traffic to their fake storefronts.
5. Younger Generations are More Vulnerable in Key Categories:
Millennials are significantly more likely to have their personal data stolen after purchasing from fake websites (44% vs. 34% average). This suggests a higher susceptibility to sophisticated phishing scams disguised as legitimate e-commerce sites.
Gen Z and Millennials are 2-4 times more likely to accidentally purchase counterfeit luxury goods and toys compared to Baby Boomers. Their online savviness might be a double-edged sword, making them more exposed to deceptive listings.
This study serves as both a consumer alert and a brand wake-up call. The rise of AI as a tool for both counterfeiters and consumers is a seismic shift that demands urgent attention. With compelling data and a clear-eyed look at accidental purchases, influencer-driven “dupe culture,” and the growing sophistication of fake storefronts, the findings paint a stark warning for the future of online shopping.
“Counterfeiting poses a serious and evolving threat to innovative businesses and consumer safety,” notes Piotr Stryszowski, Senior Economist at the Organization for Economic Co-operation and Development (OECD). “Criminals constantly adapt, exploiting new technologies and shifting market trends—particularly in the online environment. To effectively counter this threat, policymakers need detailed, up-to-date information. This study makes an important contribution to our understanding of how counterfeiters operate and how consumers behave online.” Ultimately, The Counterfeit Buyer Teardown report underscores a new reality: counterfeiting is no longer confined to shady sellers or easily spotted scams—it’s embedded in the very technologies shaping modern commerce. As AI continues to blur the lines between real and fake, the pressure is on for brands, platforms, and policymakers to respond with equal speed and sophistication. Combating this growing threat will require more than just awareness—it demands collaboration, innovation, and a commitment to restoring trust in the digital marketplace before the counterfeit economy becomes the new normal. For the Silo, Merilee Kern.
Merilee Kern, MBA is a brand strategist and analyst who reports on industry change makers, movers, shakers and innovators: field experts and thought leaders, brands, products, services, destinations and events. Merilee is a regular contributor to the Silo. Connect with her at www.TheLuxeList.com and LinkedIN www.LinkedIn.com/in/MerileeKern.
And all the media attention gives us a teaching moment to help illuminate the behind-the-scenes dynamics that affect international pharmaceutical markets, insurance companies, public healthcare systems and government finances. This article summarizes the various issues that have been in the spotlight and additional posts linked in the supplemental section at the end of this article will go further behind the curtain, using Ozempic as an example, to explain the interconnected and complex economic factors and government machinery that play roles in determining the supply, demand and accessibility of pharmaceutical treatments and products, as well as broader economic responses.
First, some background.
GLP-1 receptor agonists (like Ozempic) have been used for more than 16 years to treat type 2 diabetes and for weight loss for the past nine years. Ozempic is Novo Nordisk’s brand name for a semaglutide marketed and sold for treating type 2 diabetes. Other medications in the same class include Trulicity (dulaglutide, GLP-1) and Mounjaro (tirzepatide, a dual GLP-1/GIP).
While Ozempic is heavily associated with weight loss in the media, it is NOT approved by the FDA or Health Canada as a weight-loss drug.
From the globex press release: “GlobexPharma® is thrilled to announce the launch of Ozempic Chewable Gummies for Kids®, a groundbreaking prescription treatment designed to combat obesity in children aged 1 to 5 years.”
Health Canada approved it in 2018 for adult patients with type 2 diabetes, noting that there was limited information on safety and efficacy for minors or people over age 75. The FDA has authorized it for similar purposes and also includes reducing the risk of heart attacks and strokes in type 2 diabetes patients with known heart disease.
Wegovy, a similar injectable medication containing higher amounts of semaglutide and made by the same company, is approved for weight loss in obese patients by the FDA and recently entered the Canadian market (it was approved in 2021, but only became available to consumers in May 2024). Saxenda (liraglutide, GLP1), is approved for weight management in obese pediatric patients over 12 years of age in Canada.
The class of medications is not new, their effectiveness for weight loss in non-obese patients, as well as their potential to improve fertility, reduce cardiac risks, and reduce the risk of kidney failure have all increased the attention and discussion of this class of medications.
Their growing weight-loss popularity has disrupted the market, and provides an opportunity to investigate many interrelated market dynamics including:
The incentives and potential for pharmaceutical companies to expand markets for existing products by finding new applications for them.
Similarly, off-label prescribing by physicians can provide patients access to treatments, even if a full-scale clinical trial has not been conducted.
Market expansion through new indications and off-label prescribing can create surges in demand that increase financial risks for public and private drug insurance plans.
Similarly, rapidly increasing demand increases the risk of drug shortages, at least until manufacturing capacity can expand to meet the new market demand.
Both shortages and financial risk for insurance companies can lead to restricting coverage and rationing supplies to prioritize particular patient groups.
The healthcare market and broader economy respond to these dynamics in sometimes unexpected or potentially counterproductive ways. For example, counterfeit or black market versions of the regulated medications, a proliferation of virtual services advertising directly to consumers that they can provide access, and patients failing to complete treatment due to costs or shortages. There is evidence of wider economic responses as well.
For example, Nestlé is launching a new line of frozen pizzas and pastas enriched with protein, iron, and calcium designed for people taking appetite suppressing drugs.
That’s our landscape. For The Silo, Rosalie Wyonch.
Have you ever dreamed of owning a piece of fine art but felt that it was out of reach financially? An art auction may be the answer to your dreams! Art auctions are an excellent way to purchase original artworks without breaking the bank. With the right approach, art auctions can be a great way to build a collection of art and save money.
The benefits of an art auction
For those who are looking to add to their art collection or simply just want to try something new, art auctions can be an excellent way to obtain art. Art auctions offer a unique opportunity to purchase artwork from all over the world at competitive prices. With a broad selection of works to choose from, they provide an exciting and engaging experience.
One of the main advantages of attending an art auction is that buyers have the chance to buy authentic artwork without the risk of buying a counterfeit piece. This can save buyers both money and time since they don’t need to worry about being scammed by an online seller.
Auctions also provide an opportunity for the buyer to get to know the artist and their work, as well as to discuss any questions with auctioneers or knowledgeable collectors.
How to participate in an art auction
Attending an art auction is a great way to find unique and valuable pieces of art. But it can be intimidating if you’ve never attended one before. Here are some tips to help make sure your first experience at an art auction is a successful one. Before you attend the auction, take some time to research the artwork that is being offered. Learn about the artist and the piece you are interested in. Knowing what you are bidding on can help you make informed decisions during the auction.
The difference between an art auction and an online sale
Auctions and online sales both offer a great way for art collectors to purchase artwork, but there are some key differences between the two. An art auction is a live event where bidders compete in a competitive environment to purchase pieces of art. Bidding is fast-paced and participants must be willing to pay the highest price in order to secure the artwork they desire.
Online sales are much different in that they are usually conducted over a longer period of time. Instead of a competitive environment, buyers have the opportunity to browse through the artwork and make their selections at their own pace. This allows buyers to take their time, research the piece, and evaluate whether it’s worth purchasing or not.
Furthermore, buyers may be able to negotiate a lower price as they may not have to compete with other bidders. Another difference between an art auction and an online sale is that auctions are typically reserved for more expensive pieces of art, while online sales tend to feature more affordable artwork. As a result, those who want to purchase high-end artworks may find it more beneficial to attend an art auction than to purchase from an online store.
What a real, targeted person sees: The full fake Google Play page — here spoofing Crown Melbourne
Google Authenticator spoofed on playrosario[.]site (Google LLC · Tools)
On the left PWA “Installation” on Android, on the right Official app installation. The process also silently signs the device up for push notifications, which fire gambling reminders directly to the lock screen and are deliberately difficult to disable. Even the back button is rigged. Instead of returning users to the previous page, it reroutes them to the casino offer. 
Unlicensed casino registration with an offering of 150% up to €3,000/ $4,830 CAD + 150 FS dazard[.]com
