TL;DR: 123 live hostnames were found running one shared PWA “fake app store” kit that uses MrBeast and Chicken Road 2 branding to force-redirect visitors to casino affiliate pages every five seconds while hiding behind reviewer-safe pages and push-token collection, according to Bfore's PreCrime Labs.
At a glance
What this is: Bfore reports a persistent PWA-based brand-lure campaign using celebrity and game names to funnel visitors into casino affiliate traffic while collecting push permissions and tokens.
Why it matters: It matters because fraud, brand abuse, and notification abuse now combine into a repeatable lure-and-redirect pattern that can bypass casual review and persist after domain takedowns.
Context
This campaign is best understood as a brand-abuse and traffic-monetisation operation, not a conventional malware incident. The kit imitates an app store or game page, then shifts the visitor into casino affiliate flows while using benign-looking pages to mask what reviewers see.
The identity angle is about trust exploitation, not account compromise. When a public figure's name, a game title, and a store-like interface are combined, the operator borrows legitimacy to increase installs, notification consent, and click-through, which is why brand verification and channel control matter here.
The persistence of the kit also changes the response model. Disabling a domain is useful, but if the underlying Firebase project, TDS account, and shared script bundle remain live, the operator can replenish hostnames and relaunch quickly.
Key questions
Q: What breaks when a brand-lure PWA uses safe pages and money pages to evade review?
A: Reviewers can see a benign page while victims get routed to affiliate destinations, so page-level checks miss the actual abuse path. Effective response needs configuration review, backend clustering, and redirect tracing, not just visual inspection of the landing page.
Q: Why do shared config files make affiliate abuse easier to disrupt?
A: Shared configuration leaks let defenders tie many hostnames to one operator, which reduces the problem from dozens of domains to one control plane. That makes takedown, blocking, and attribution more efficient because the operator's reusable identifiers become the main pivot points.
Q: How do security teams spot push-notification abuse in fake app-store pages?
A: Look for permission prompts followed by token submission, then repeated re-engagement from the same estate. If a page depends on browser push to keep driving traffic after the first visit, treat the notification channel as part of the abuse chain, not a separate feature.
Q: When should brand owners escalate impersonation listings versus domain takedowns?
A: Escalate both when a listing and its associated domains borrow the same brand cues, because the listing supplies legitimacy while the domains deliver monetisation. Removing only one side often leaves the operator enough trust or infrastructure to relaunch quickly.
Technical breakdown
How shared PWA kits separate review pages from money pages
A progressive web app can present different content depending on routing, visitor profile, or configuration fetched from the backend. In this case, the kit uses a traffic-distribution system with fields such as safe_pages and money_pages, so reviewers may see a benign-looking store page while victims are pushed toward affiliate destinations. The same script bundle across many hosts reduces operator effort and makes takedown work harder because the abuse is in the shared logic, not just in one domain.
Practical implication: defenders should inspect the shared bundle and routing logic, not only the visible landing page.
Why readable config endpoints become operator intelligence leaks
A publicly readable /config.json endpoint is more than an implementation mistake. It can expose operational identifiers such as account UUIDs, stream IDs, and team IDs, which helps defenders correlate hosts to one operator and cluster infrastructure faster than domain-level blocking alone. When the configuration is consistent across many hosts, the config becomes the better pivot than the domain name. That matters because rolling domains are easy to replace, while shared control-plane artifacts are harder to conceal.
Practical implication: treat exposed configuration files as prioritised intelligence sources for clustering, attribution, and takedown scope.
How push permission abuse extends the lifetime of a lure campaign
Push notifications let a campaign re-engage a user after the initial visit, which extends the monetisation window beyond a single click. Once a browser token is collected, the operator can send repeated prompts or redirects without needing the user to rediscover the site through search. In this campaign, that push flow sits alongside the casino affiliate redirect path, turning a one-time brand lure into an ongoing traffic channel. The real control problem is consent capture and token persistence, not just domain reputation.
Practical implication: monitor for abusive push enrollment and treat token collection as a durable abuse signal.
Threat narrative
Attacker objective: Monetise casino affiliate traffic by borrowing celebrity trust, collecting push access, and repeatedly redirecting victims into betting offers.
- Entry occurs when a user lands on a celebrity- or game-branded PWA page that imitates an app store or free game.
- Credential_harvested is not the primary goal here; instead the kit collects push notification permission and browser tokens for future re-engagement.
- Escalation happens when the visitor is force-redirected every five seconds to casino affiliate pages, turning trust abuse into monetised traffic conversion.
- Impact is ongoing affiliate revenue, repeated notification spam, and persistent brand damage across a rolling estate of hostnames.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
- Google API Keys Exposure — Gemini AI: Google API keys exposed in client-side code via Gemini AI integrations, creating data leak risk.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Brand-lure infrastructure is now a governance problem, not just a takedown problem: the operator's value comes from the combination of lure, consent capture, and redirect logic. That means the control boundary is wider than domain blocking and has to include trust signals, push permissions, and infrastructure clustering. Practitioners should treat the routing layer as the real asset under abuse.
Readable control-plane endpoints create a recovery path for defenders: exposed configuration files can reveal shared operator identifiers, which turns a sprawling hostname set into a manageable cluster. In brand-abuse campaigns, the decisive question is often not whether a page is malicious, but whether several pages share the same backend control path. That makes configuration exposure a defender advantage when it is visible.
Trust exploitation is the core security failure here: the scheme works because users are encouraged to transfer confidence from a public figure, a game title, and a store-like interface onto an unverified monetisation path. This is a verification failure as much as a fraud problem, and it shows why identity verification, brand authentication, and channel governance are converging concerns. Practitioners should tighten the boundary between recognised brands and monetised distribution paths.
Persistent affiliate abuse behaves like an ecosystem, not a single campaign: 123 hostnames, one Firebase project, and shared scripts create an operational mesh that survives individual takedowns. That is the named concept here: lure-rehost persistence, where the lure can be regenerated faster than reviewers can respond. Security teams should plan for renewal, not one-off removal.
What this signals
Lure-rehost persistence: the campaign's real resilience comes from the ability to swap domains while keeping the same backend control logic. That means security teams should measure success by how quickly they identify the shared operator path, not by how many individual URLs they block.
Brand abuse, push consent, and affiliate monetisation now reinforce each other in a single workflow. For practitioners, the lesson is to treat consumer-facing trust signals as security signals when a page asks for install permission, notification access, or repeated redirection.
A single Firebase project and TDS cluster can turn what looks like a noisy set of clones into one recoverable operation. That is why backend identifiers, not just visible content, should drive prioritisation in takedown and monitoring programmes.
For practitioners
- Block and cluster by shared infrastructure Use the shared script bundle, /config.json exposure, Firebase project, and TDS account UUID to cluster related hosts before you start individual takedowns.
- Report push-capable abuse paths Escalate any discovered Firebase project and app identifiers to the platform provider so push collection and re-engagement can be suspended across the estate.
- Audit brand-lure search and app-store exposure Look for creator-plus-game keyword combinations, fake review signals, and verified-badge misuse in listings that try to borrow brand trust.
- Sinkhole the highest-confidence domains first Prioritise hosts that expose the kit fingerprint, readable config, and identical PHP endpoints so disruption lands on the shared control path rather than isolated replicas.
- Notify brand and trust-and-safety teams Coordinate with the impersonated brand owner and platform abuse teams so takedown requests, policy reports, and public warnings align on the same campaign cluster.
Key takeaways
- This campaign shows how fake app-store pages can convert brand trust into recurring affiliate revenue without needing credential theft or malware payloads.
- The exposed configuration and shared backend identifiers make the estate easier to cluster than the hostname count suggests.
- Practitioners should respond by tracing the control plane, not just blocking individual domains, because the operator can rehost the lure quickly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0011;TA0040 — Initial Access; Command and Control; Impact | The campaign relies on lure entry, push-driven re-engagement, and monetisation impact. |
| Recommendation — Map the campaign to TA0001, TA0011, and TA0040 to prioritise entry points and control-plane disruption. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Notification permissions and backend access paths are central to the abuse lifecycle. |
| Recommendation — Apply PR.AA-05 to govern permission requests, token issuance, and access scope for web-based push channels. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The abuse depends on a shared application bundle and malicious web app behaviour. |
| Recommendation — Use CIS-16 to inspect application behaviour, script integrity, and embedded redirect logic in hosted pages. | ||
| OWASP API Security Top 10 | API9 — Improper Inventory Management | The campaign relies on many related hosts sharing one control plane and duplicated endpoints. |
| Recommendation — Inventory all related endpoints and configs so cloned hosts are grouped before remediation. | ||
Key terms
- Traffic Distribution Service: A traffic distribution service is infrastructure that routes visitors through filtering, redirection, and landing-page logic before they reach a final payload site. Threat actors use it to hide destinations, block sandboxes, and deliver different content to different targets or geographies.
- Payment Token: A payment token is a stand-in value that represents a real card account without exposing the underlying credentials. It keeps the transaction usable while removing the original card number from most systems, reducing the value of intercepted data to attackers.
- Brand-Lure Infrastructure: Brand-lure infrastructure is hosted content that borrows names, logos, or recognisable themes to make a page look trusted. The purpose is usually conversion, fraud, or affiliate monetisation, and the security failure is trust transfer from the real brand to an unverified operator.
- Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to broader security operations.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org