Flash Notice: MrBeast & Chicken Road 2 Casino Affiliate Scam & Mitigation Guidance

PreCrime Labs discovered a persistent PWA "fake app store" kit deployed across 123 hostnames (93 apex domains) that impersonates MrBeast/Chicken Road 2 to harvest push tokens and force-redirect victims to casino affiliate offers every ~5 seconds; the estate serves identical kit files, exposes a readable /config.json leaking a TDS account_id, uses a single Firebase project for push collection (single point of disruption), has run continuously for 14 months, and provides curated IOCs and mitigation recommendations.