BetterDeals - Work.ink scamming with another name

You may have heard of Honey, the browser extension owned by PayPal that was exposed for secretly stealing affiliate commissions from content creators. Lawsuits followed. Millions of users uninstalled it. It became one of the biggest browser extension scandals in recent memory.

BetterDeals does the same thing. And it was built by the same person behind Work.ink, an ad network we already reported on for exposing publisher accounts through broken authentication. That report is here if you missed it.

What is BetterDeals?

BetterDeals is a browser extension on the Chrome Web Store with around 90,000 users. It promises to compare prices across retailers and help you find better deals when you shop online. It is free, and its Chrome Web Store listing claims it does not collect personal data.

That claim is false.

The scale of the problem

90,000 users. According to various e-commerce studies, the average Amazon user makes roughly 25 purchases per year, with an average order value around $40 to $50. Affiliate commissions on Amazon typically range from 1% to 10% depending on category, averaging around 3% to 4%.

Conservative estimate: 90,000 users x 25 purchases x $45 average order x 3.5% commission = approximately $3.5 million per year in affiliate commissions being redirected away from the original referrers and into BetterDeals and their network partners. Every year. Silently. From 90,000 people who installed a free "deal finder."

What does it actually do?

Every time you visit a page on Amazon or another supported retailer, the extension silently sends the full URL to BetterDeals servers. This happens automatically, without you clicking anything, without you being asked.

It does not limit this to shopping sites. Here it is sending requests while visiting trw.lat, a personal developer bio page with no products and no store:

Every page you visit gets logged, tagged with a unique fingerprint per browser: betterdeals-8efcf961-21a8-457a-a13d-8c8ebaf0e854

The affiliate hijacking, step by step

When you arrive at a retailer through an affiliate link, that link contains a tag identifying who referred you. If you buy something, that person gets a commission. BetterDeals intercepts that process and takes the commission for itself.

You start at an Amazon link from RetailMeNot with their affiliate tag: tag=ret-20

While the page loads, BetterDeals sends that URL to its redirect API. The response:

The extension silently redirects your browser. That URL passes through two affiliate networks:

You end up on Amazon. The page looks normal. But the original tag is gone:

tag=ret-20 replaced by tag=maas. irgwc=1 means Impact Radius Got With Click, confirming an affiliate network captured this referral. That network is BetterDeals, through Sovrn and VigLink. RetailMeNot gets nothing.

Watch it happen live

Method 1, routing through res.betterdeals.gg:

Method 2, direct redirect, harder to intercept, same outcome:

The Work.ink connection

BetterDeals is operated by Alexis Sreckovic, the same person who founded and runs Work.ink. This is not just a shared owner. The two products are actively integrated.

Work.ink's ad API serves BetterDeals ads directly to publishers and their visitors. This does not happen on every page load, it appears to vary by geography, browser, or other targeting factors, but it is a consistent and documented pattern. Here is the Work.ink monetization endpoint returning an ad routing traffic through BetterDeals:

The ad URL routes through gadgets-tab.betterdeals.gg/visit?url=...&ppref=betterdeals.gg. Work.ink publishers show this to their visitors. Those visitors click it. BetterDeals gets the traffic and the affiliate commission.

A second ad in the same API routes a "Get Robux for CHEAP" offer through res.betterdeals.gg/redirect/, the exact same redirect infrastructure used for the affiliate hijacking documented above:

Work.ink pushes BetterDeals onto minors

Work.ink is used heavily by people sharing game mods, Roblox content, and cheats. A large portion of that audience is under 18.

Inside Work.ink's obfuscated frontend code, there is logic that shows visitors a mandatory offer to install BetterDeals. No age check. No real opt-out. Just an install prompt shown to anyone who clicks a Work.ink link, including children who came looking for a Roblox mod:

What their privacy policy says vs. what actually happens

Chrome Web Store listing: "No personal data collection. Works completely in your browser."

Actual behavior: every URL you visit on any page, not just shopping sites, is sent to their servers tagged with a unique browser fingerprint. Their privacy policy does not mention Sovrn, VigLink, or Impact Radius anywhere, despite those networks receiving user data on every redirect. Under GDPR Article 5, third parties receiving personal data must be disclosed. They are not.

How is this different from Honey?

The method is identical. Honey intercepted navigation, passed it through an affiliate redirect, and replaced the original referrer's commission. Honey lost millions of users and is facing class action lawsuits.

BetterDeals does the same thing without even a standdown system. Honey at least tried to behave correctly when compliance testers were watching. BetterDeals does it every time, on every page, for every user, including children, without any detection evasion because apparently nobody was looking.

What you should do

Uninstall BetterDeals. If your audience has it installed, every purchase they make through your affiliate links may be generating commission for BetterDeals instead of you.

If you are a publisher on Work.ink, be aware that the same operator running your ad network is also running a browser extension that intercepts affiliate commissions and is being pushed onto minors without age verification.

If you are in the EU, you can file a complaint with your national data protection authority. In Germany: bfdi.bund.de. The combination of undisclosed data collection, affiliate fraud, undisclosed third party data sharing, and installation on minors without consent covers multiple violations across GDPR Articles 5, 6, and 8.

All findings were reproduced using a clean browser profile with DevTools open. No systems were accessed without authorization. The goal is to inform users and publishers before someone with worse intentions acts on this first.

Thanks to Jigger? @ skipped.lol for the initial hints that led to this research.

Related report: Work.ink - The First Vibecoded Ad Network?