NordVPN says Meta ad tools were used in a 7,200-hit hidden gambling campaign across Facebook and Instagram

NordVPN says it uncovered a large-scale operation, pwa_betterlinks, that used Facebook and Instagram advertising tools to push illegal gambling. For PSPs and operators, the useful part is not the theatre around the ads themselves, but the distribution model: commercial traffic acquisition tooling, PWA installs, and push subscriptions feeding unlicensed gaming sites.

1. According to NordVPN, the campaign generated more than 7,200 user-facing impressions of casino pages and more than 3,100 bait pages shown to automated verification systems. The ads themselves borrowed logos from 400+ legitimate companies, including Google Authenticator, Kalshi, Disney+, Duolingo, Delta Air Lines, and several national lotteries.
2. Users who clicked through were taken to fake Google Play Store pages. Instead of real apps, the flow installed web apps, or PWAs (progressive web apps), on the user’s device.
3. Those PWAs then placed shortcuts on the device and subscribed users to push notifications carrying gambling ads. In practice, that gives the operator a repeat channel back to the device without needing a store-listed app.
4. NordVPN says the infrastructure works like a commercial affiliate platform and is sold through Betterlinks. The same setup is reportedly used by hundreds of affiliate accounts to drive traffic to unlicensed gambling sites.

For high-risk businesses, the point is simple: Meta inventory, affiliate tooling, and PWA delivery can be stitched together into a traffic funnel that looks like ordinary performance marketing until someone checks where the clicks actually land.