Scammers are quietly hijacking the names and logos of hundreds of well-known companies, then blasting slick social-media ads at users, including in Cleveland, to trick them into installing bogus apps that are really just shortcuts to online casinos, researchers say.
Instead of sending people to legitimate app stores, the ads push fake Google Play pages or home-screen “installs” that are actually Progressive Web Apps, or PWAs, dressed up to look like trusted brands. Tap the ad, tap “install,” and you end up with what appears to be a real app icon on your phone. Under the hood, though, it simply opens a browser window and drops you on a gambling site.
As reported by Cleveland.com, NordVPN’s Threat Intelligence unit says the operation has copied more than 400 established brands and used polished ad campaigns to sell fake Google Play listings. Those pages were padded with phony star ratings and thousands of fabricated reviews, all tailored to make the “apps” look as safe and familiar as anything you would find in a real app store. According to NordVPN, once users land on these pages, they are prompted to add a shortcut to their device’s home screen that carries the impersonated brand’s name and logo.
How the scam works
Security firm Netcraft traced the full ad pipeline: a paid Facebook or Instagram spot leads to a scam-controlled landing page that mimics a Google Play listing or a slick brand promotion page. The big “Install” button does not send you to the real Play Store, it spins up a PWA instead…