On July 27, VPN service NordVPN reported the discovery of a fraudulent network named pwa_betterlinks. This network has been using logos and names of over 400 well-known brands in paid advertisements on Facebook and Instagram to redirect users to unlicensed online casino sites.
Among the brands involved are Google Authenticator, Disney, Duolingo, Delta Air Lines, the prediction markets platform Kalshi, and several national lotteries.
According to NordVPN, clicking on an advertisement leads users to a fake Google Play page that offers to install a PWA disguised as the advertised brand's application. This PWA adds a shortcut to the user's device and activates a subscription for push notifications featuring gambling offers.
The network circumvents moderation through cloaking techniques. Researchers recorded over 7,200 views of casino pages by real users and more than 3,100 views of placeholder pages by automated ad verification systems. The infrastructure is believed to operate as a commercial affiliate platform, with hundreds of affiliate accounts using Betterlinks technology to drive traffic to unlicensed operators.