NordVPN’s Threat Intelligence Team has identified a coordinated campaign targeting Android devices with counterfeit advertisements for established brands. The operation directs users toward unlicensed gambling platforms through social media networks.
Ad Hijacking Methodology
The criminal network utilizes Instagram and Facebook to display promotional material for recognized services such as Google, Disney+, and Duolingo. Users who interact with these listings are rerouted to unauthorized betting websites instead of the official brand pages. NordVPN’s analysis indicates that the group operates on a large scale, employing advanced targeting techniques to mimic legitimate corporate campaigns.The provider’s report confirms that the deception relies on platform algorithms to distribute the false advertisements across multiple user feeds. Android devices are the primary target of this distribution method, with the criminal group maintaining consistent ad placement across the tracked social networks.