The Threat Intelligence team at NordVPN has revealed a significant cyber campaign that entails the use of fraudulent mobile app downloads and the impersonation of reputable global brands to redirect unsuspecting users to unlicensed online gambling platforms. This operation, dubbed “pwa_betterlinks,” is reportedly targeting over 400 well-known brands through advertisements on Facebook and Instagram, including names like Kalshi along with various country operators, urging individuals to download what appear to be legitimate apps.
However, instead of leading users to the authentic Google Play Store or Apple App Store, these ads connect them to counterfeit app store sites that closely resemble Google's interface. Once on these fake sites, users are prompted to install a Progressive Web App, which adds an icon on their device and subscribes them to browser push notifications promoting illegal online casinos and betting options.
Experts at NordVPN noted that the operation employs sophisticated technology capable of evading the content moderation systems used by social media networks. Automated review processes detect only benign sites, while actual users are diverted towards gambling-related pages. In their investigation, NordVPN identified more than 7,200 instances of user redirection to these sites, compared to the 3,100 fake pages utilized in ad reviews.
Marijus Briedis, the Chief Technology Officer at NordVPN, described this deceptive tactic as a form of "trust laundering," where malicious entities exploit the credibility of established brands to instill a false sense of security in customers, thus leading them to lesser-known gambling websites.
