The cybersecurity company Malwarebytes has uncovered a fraudulent network known as FriendlyDealer. This network utilizes at least 1,500 domains featuring fake Google Play and App Store pages, redirecting users to unregulated online casino sites.
According to Malwarebytes, the network consists of at least 20 counterfeit applications under various names, including Tower Rush (189 listings), Chicken Road (97), and Beast Games: Ice Fishing (43). Some of these apps mimic the brand of YouTube influencer MrBeast, as well as applications associated with the fintech service Revolut and the Gates of Olympus slot from Pragmatic Play.
Interestingly, Malwarebytes reports that the network does not steal passwords or distribute malware. Instead, the operators profit from affiliate commissions for registrations and deposits, which reportedly range from $50 to $400 for each player who makes a deposit. The unified template allows for the rapid creation of new applications in just minutes by altering a single configuration file. The source code contains comments in Russian and integrates with Yandex Metrica, although Malwarebytes notes that these artifacts may have been inherited from acquired or reused code.