NordVPN uncovers criminal network hijacking brands to redirect to illegal gambling sites

Dig Deeper

The Backstory

Trust becomes the entry point

NordVPN’s findings fit into a broader pattern that has become harder for regulators, platforms and consumers to separate from legitimate digital commerce: illegal gambling operators are no longer relying only on obscure websites or spam links. They are borrowing the appearance of trusted brands, buying access to mainstream advertising channels and routing users through technical systems designed to defeat platform reviews.

The operation described by NordVPN, which it tracks as pwa_betterlinks, shows how that model can work at scale. The network allegedly used the names and logos of more than 400 global brands, including technology, streaming, travel, casino and lottery companies, to move users from Facebook and Instagram ads to fake Google Play Store pages and then to unlicensed casinos. The technique exploits the credibility of three separate layers: household brands, major social media platforms and familiar app-installation flows.

That method helps explain why illegal online gambling has become a wider enforcement problem rather than only a licensing dispute. Operators or affiliates can use lawful-looking digital infrastructure to create a short path from ordinary consumer behavior to unregulated wagering. In NordVPN’s account, the fake app pages did not install legitimate software. They created shortcuts, enrolled users in push notifications and directed them toward casino deposit pages, while automated ad-review systems were allegedly shown decoy content.

Ad platforms face growing scrutiny

The use of paid social media ads is a recurring feature in recent complaints about illegal gambling. In India, the Digital India Foundation warned that offshore betting operators depend on a mix of advertising, marketing, payments and software providers to reach consumers. Its report said four offshore platforms drew more than 1.6 billion visits between October and December 2024, with social media responsible for 42.8 million visits through paid ads, promoted content, influencer campaigns and engagement efforts.

The foundation’s call for stricter enforcement against illegal online gambling sites underscored the same vulnerability NordVPN identified: big technology platforms can become distribution channels even when the gambling operator itself is offshore, unlicensed or hidden behind affiliates. The foundation urged regulators to work with companies such as Google and Meta and said payment systems should block transactions to illegal sites.

NordVPN’s findings add a cybersecurity layer to that policy debate. The issue is not only whether gambling ads are being approved or whether a platform can identify an unlicensed operator. It is whether fraud networks can cloak the user journey so reviewers see one version of a page while the intended target sees another. If that is widespread, enforcement that depends on automated scanning and complaint-based takedowns is likely to lag behind the pace of the campaigns.

Affiliates blur accountability

The alleged link between the pwa_betterlinks operation and an affiliate network is significant because gambling enforcement often becomes more difficult when acquisition, branding and user routing are handled by third parties. Affiliate marketers can sit between casinos and consumers, driving traffic through offers, ads and search placements. In regulated markets, that model is subject to advertising rules and operator oversight. In unregulated markets, it can create plausible distance between the gambling site and the deceptive method used to acquire users.

That distance matters for consumers. A user who clicks on what appears to be an ad for a familiar app may not know which company bought the ad, which entity created the landing page, which casino receives the deposit or where the operator is based. By the time the user reaches a registration page, the trust signal has already been transferred from a known brand to an unknown gambling site.

It also matters for enforcement. Regulators may be able to pursue licensed operators in their jurisdiction, but a network using disposable domains, fake developer names, forged reviews and cloaking technology can reappear quickly. When the acquisition funnel is built to misdirect both consumers and automated checks, brand owners, ad platforms, app stores, payment processors and gambling regulators each hold only part of the evidence needed to disrupt the network.

Illegal gambling intersects with financial crime

Concerns about illegal online gambling are increasingly tied to money laundering, fraud and cross-border crime. The Digital India Foundation warned that illegal gambling can contribute to financial crimes, while Chinese authorities have pursued cases linking online gambling platforms to broader fraud networks. In one recent case, Chinese police confirmed the extradition of Liu Ren from Cambodia as part of an investigation connected to businessman Chen Zhi and alleged transnational fraud and illegal online gambling operations.

Authorities said Liu was tied to Jinbei Group, which allegedly operated online gambling platforms targeting Chinese residents and later expanded into managing telecoms fraud compounds in Cambodia. The extradition of a figure linked to the Chen Zhi investigation highlighted how online gambling infrastructure can overlap with alleged fraud compounds, illegal detention and other criminal activity.

The NordVPN case is different in form. It focuses on brand hijacking, advertising abuse and deceptive app-style funnels rather than alleged physical compounds or extraditions. But the underlying risk is connected: unregulated gambling channels can provide both revenue and cover for networks operating across borders. They can collect deposits, move funds through opaque payment pathways and exploit users in jurisdictions where consumer protections do not apply.

For legitimate gambling companies, the stakes include reputational harm as well as lost revenue. NordVPN said even established casino and lottery brands were impersonated. That means licensed operators can be used as bait for illegal rivals, while consumers may mistakenly associate the bad experience with the real brand. The harm spreads beyond the victim who deposits money into an unlicensed site.

Regulatory lines are already under strain

The rise of deceptive gambling funnels comes as regulators are already debating how far traditional gambling laws can reach in digital markets. The dispute over prediction markets in the U.S. shows how quickly product classification can become a legal battleground. Arizona Attorney General Kristin Mayes filed criminal charges against Kalshi, alleging it was illegally accepting wagers on sports, player props, elections and other events in the state.

Kalshi and similar platforms argue they operate federally regulated financial exchanges where users trade event contracts rather than place bets with a bookmaker. States have pushed back, especially where sports or election markets are involved. Arizona became the first state to file criminal charges, escalating a conflict that had already drawn action from more than 10 states. The case followed Kalshi’s own pre-emptive lawsuit seeking to prevent Arizona from stopping its operations.

Kalshi co-founder Tarek Mansour later said Arizona had overstepped, arguing the criminal case was an unjustified escalation of a regulatory dispute. His response to Arizona’s criminal charges against Kalshi reflected a separate but related pressure point: the boundary between gambling, financial products and state enforcement is becoming more contested as online products evolve.

Unlike Kalshi, the NordVPN-linked operation is not arguing for a regulated status or a novel legal classification. It is alleged to be impersonating brands and steering users to unlicensed casinos. Still, both situations show why regulators are under pressure to act faster. Digital wagering products can reach users across state and national borders before authorities resolve whether they are licensed, illegal, deceptive or merely outside an existing category.

The next fight is over the funnel

NordVPN’s report points toward a practical enforcement problem: shutting down illegal gambling sites is not enough if the acquisition funnel remains intact. The ads, domains, cloaking scripts, fake app pages, push-notification permissions and payment routes are all part of the same system. Removing one landing page may not matter if affiliates can rotate domains and relaunch the campaign under another brand’s logo.

That is why recent calls for enforcement increasingly focus on cooperation among technology companies, regulators and financial intermediaries. Social media platforms control ad access. Browser and security companies can identify suspicious domains and cloaking behavior. Payment providers can block deposits. Brand owners can report impersonation. Gambling regulators can identify unlicensed operators and warn consumers. None can see the full chain alone.

The immediate risk for users is financial loss to casinos that may have no license, no responsible gambling controls and no meaningful dispute process. The broader risk is that trust in routine digital interactions erodes. If a paid ad for a familiar app can lead to a fake store page and then to a casino deposit screen, the distinction between ordinary consumer activity and criminal redirection becomes less obvious. That is the vulnerability NordVPN says this network is exploiting, and it is why illegal gambling enforcement is moving from the edge of the industry to the center of digital platform governance.