NordVPN Uncovers Fake Apps Promoting Illegal Gambling Sites

NordVPN’s Threat Intelligence team has discovered a major cyber operation that uses counterfeit mobile app downloads and the reputation of well-known brands to direct users toward unlicensed online gambling platforms.

The cybersecurity company identified the campaign as “pwa_betterlinks” which involves more than 400 impersonated brands appearing in sponsored advertisements across Facebook and Instagram. The ads encourage users to download apps linked to various recognised names, including Kalshi and other operators.

However, instead of leading users to official app marketplaces such as the Google Play Store or Apple App Store, the advertisements redirect them to fake app store pages designed to look similar to legitimate platforms. Users are then encouraged to install a Progressive Web App (PWA), which adds an icon to their device and enables browser notifications promoting illegal online casinos and betting services.

NordVPN researchers said the campaign uses sophisticated methods to avoid detection by social media moderation systems. Automated checks reportedly view harmless pages, while actual users are redirected to gambling-related destinations. During its investigation, NordVPN identified more than 7,200 user redirection records compared with around 3,100 fake pages presented during advertising reviews.

According to Marijus Briedis, Chief Technology Officer at NordVPN, the operation represents a form of “trust laundering” where cyber actors exploit the reputation of established brands to make fraudulent campaigns appear more reliable and guide users toward unrelated gambling websites.