Android users are being urged to immediately check their push notification permissions following the discovery of a new scam. According to cybersecurity firm NordVPN, criminals are running paid adverts on Facebook and Instagram that impersonate over 400 trusted brands to redirect people to unregulated online gambling sites.
How the scam works
The attack begins with ads that claim to offer access to popular apps such as Disney+, Google Authenticator, and the National Lottery. Clicking the ad takes users to a page that mimics Google's official Play Store, but the applications are fake. Instead of installing a legitimate app, the malicious package hides on the phone and silently signs the device up for push notifications that fire gambling reminders directly to the lock screen. These notifications are deliberately difficult to disable — even the back button is rigged to reroute users to the casino offer instead of the previous page.
NordVPN's findings
NordVPN's Threat Intelligence research unit has named the network behind the scheme 'pwa_betterlinks'. The operation hijacks logos and names of household brands including Kalshi, Duolingo, Delta Air Lines, and national lotteries. Marijus Briedis, chief technology officer at NordVPN, described it as 'trust laundering'. He said: 'Criminals take the credibility that legitimate companies have spent years building and redirect it toward their own ends. By the time a victim realises something is wrong, they've already deposited money into a casino they've never heard of.'
How to stay safe
NordVPN urges users to be wary before installing any new apps and to review push notification permissions. To stay safe, go to your phone's settings and check which websites have permission to send you alerts. Revoke anything you don't recognise. Additionally, a real app install always opens the official store — if tapping 'Install' in an ad opens a web page rather than the Google Play Store or Apple App Store, stop immediately. Always check the address bar: a genuine Google Play listing lives at play.google.com. Any other web address showing a store-style page, no matter how accurate the branding, is a fake.
