Our friends at NordVPN’s Threat Intelligence team has just uncovered a criminal network running paid Facebook and Instagram ads that impersonate over 400 trusted brands — from Google Authenticator and Kalshi to national lotteries — to trick people into fake app installs that redirect them to unlicensed online casinos. 

The operation is not the work of a lone scammer.

It is a rented criminal platform, actively running today, used by roughly a thousand affiliates across more than 250 teams. This large-scale criminal operation hijacks the logos and names of over 400 trusted brands to redirect unsuspecting people toward unregulated online gambling. The network — which NordVPN tracks as pwa_betterlinks — runs paid adverts on Facebook and Instagram impersonating household names including Google Authenticator, Kalshi, Disney+, Duolingo, Delta Air Lines, and national lotteries. 

Victims who tap the ad are shown a fake Google Play Store page that is nearly impossible to distinguish from the real thing. One tap of “Install” later, they land on an unlicensed casino asking for a deposit. What a real, targeted person sees: The full fake Google Play page — here spoofing Crown Melbourne

“What we’re looking at is essentially trust laundering. Criminals take the credibility that legitimate companies have spent years building and redirect it toward their own ends. By the time a victim realizes something is wrong, they’ve already deposited money into a casino they’ve never heard of.” Marijus Briedis, chief technology officer at NordVPN.

The fake app store hiding inside a social media ad 

Every victim’s journey starts with a paid ad on Facebook or Instagram. A real, purchased placement that carries the implicit legitimacy of a platform people use every day. Clicking it takes users to what appears to be a genuine Google Play Store listing, complete with the brand’s logo, a forged developer name, a 4.9-star rating, and thousands of fabricated reviews. The only visible tell is the web address in the browser bar — a random throwaway domain rather than play.google.com. Google Authenticator spoofed on playrosario[.]site (Google LLC · Tools)

The impersonated brands span casinos and national lotteries (Crown Melbourne, Holland Casino, EuroMillions), mainstream apps (Google Translate, Google Authenticator, YouTube Kids, Adobe Acrobat, Shazam), financial services (Capital One, Credit Karma, Kalshi), streaming (HBO Max, Disney+, Peacock), and travel (Delta, United, Airbnb). 

The Install button that installs nothing

Tapping Install triggers a convincing fake progress bar. No app is downloaded. What actually happens is a shortcut — a Progressive Web App, or PWA — is silently added to the home screen under the impersonated brand’s name and icon. A PWA is not a real app. It is a website that looks like one, sitting on a phone’s home screen with zero app store vetting required. The criminal can spin up a new fake page as fast as they can register a domain. On the left PWA “Installation” on Android, on the right Official app installation. The process also silently signs the device up for push notifications, which fire gambling reminders directly to the lock screen and are deliberately difficult to disable. Even the back button is rigged. Instead of returning users to the previous page, it reroutes them to the casino offer. 

A commercial product designed to evade detection

Before any real page is shown, every click passes through a cloaking layer that checks whether the visitor is a human or an automated scanner — including Facebook’s own ad review bots. Checkers are served a blank decoy page. Real users are served the fake casino funnel. Across NordVPN’s captured dataset, the casino page was served 7,261 times; the decoy was served to checkers 3,153 times. The people doing the checking never see what the actual targets see. The network is structured as a commercial product, not a one-off scam. At the top sits betterlinks[.]pro, a platform that markets itself openly as a “PWA constructor for affiliates” with built-in cloaking and Facebook optimization. Unlicensed casino registration with an offering of 150% up to €3,000/ $4,830 CAD + 150 FS dazard[.]com

 In the middle sit roughly a thousand affiliate accounts across more than 250 teams who rent the kit and buy social media traffic to run campaigns. At the bottom are the unlicensed casinos and CPA networks that pay the affiliates a commission for every user who registers or deposits — with captured records linking the operation to the Makeberry Affiliates network and casinos. 

How to stay safe?

 Marijus Briedis advises anyone using social media to keep three things in mind: A real app install always opens the official store. If tapping “Install” in an ad opens a web page rather than the Google Play Store or Apple App Store, stop immediately. Check the address bar. A genuine Google Play listing lives at play.google.com. Any other web address showing a store-style page — no matter how accurate the branding — is a fake. Review your push notification permissions. Go to your phone’s settings and check which websites have permission to send you alerts. Revoke anything you don’t recognize.

Methodology

The investigation began by identifying a shared template fingerprint across a cluster of fake app-store pages, which NordVPN used to recover live instances of the operation at scale. From there, analysts mapped the full funnel logic through network traffic analysis and JavaScript deobfuscation, revealing the infrastructure connecting individual affiliate accounts to their campaigns, destination casinos, and real Facebook Business ad pixels. Domain registration records, hosting provider data, and code-level signals — including language markers in the push notification code — were used to support operator attribution. All indicators of compromise are analyzed in machine-readable format (STIX 2.1, 880 indicators). Conclusions are based on verified data, with the perimeter of the identified systems delimited with the maximum possible accuracy.

For the Silo, Vilius Kardelis.