Infoblox: Hotejka Affiliate Uses 20k Cloudflare Pages for Help TDS Tech Support Scams

Infoblox researchers reported that the Help TDS traffic distribution system is using more than 20,000 Cloudflare Pages subdomains to deliver tech support scams. The security firm assessed with high confidence that this operation is run by Hotejka, a Russian-language affiliate program that appears to be a rebrand of the older ROI777 campaign.

The investigation, detailed in a report shared with The Hacker News, traces the Help TDS infrastructure back to at least April 2017. Researchers noted that historical DNS records, shared infrastructure, persistent affiliate identifiers, and consistent command-and-control mechanisms connect the entities. The operation routinely hands off traffic to other cybercrime operators, including VexTrio Viper, which facilitates scams and riskware distribution.

Evolution of the Campaign

The Help TDS ecosystem has evolved from traditional website compromises to utilizing disposable hosting infrastructure. According to GBHackers, the operation has used pages.dev infrastructure since April 2026, announcing approximately 300 new domains daily through Telegram channels. This shift allows attackers to rapidly deploy and discard malicious landing pages while maintaining a steady flow of victim traffic.

Earlier iterations of the campaign relied heavily on compromised WordPress sites. GoDaddy documented in August 2025 how affiliates injected a malicious plugin named "woocommerce_inputs" into thousands of websites. This plugin, unrelated to legitimate WooCommerce software, harvested user credentials and fetched redirect URLs from command-and-control servers. GoDaddy estimated that this specific plugin campaign affected more than 10,000 websites, serving as a primary feeder for the tech support scams.

Victim Impact and Tactics

Victims are directed to fraudulent call centers through carefully crafted URLs distributed via compromised websites, malvertising, spam, social media, and even a Telegram bot posing as a free AI assistant. The Help TDS system evaluates browser characteristics and geographic location before selecting a destination. Traffic deemed unsuitable for tech support scams is resold through other affiliate platforms, maximizing the monetization of stolen web traffic.

Once a victim lands on a malicious page, they encounter fabricated update notifications and warnings claiming Microsoft has disabled their computer. The scams employ full-screen manipulation, exit prevention, flashing alerts, and recorded instructions to create the impression of a system lock. During a June 2026 investigation, Infoblox researchers contacted one advertised number. An operator impersonating Microsoft support instructed them to clear the browser lock and download UltraViewer, a legitimate remote desktop application.

Granting access through such tools would create an opportunity for further abuse, including the installation of living-off-the-land malware. Infoblox noted that the operation combines compromised websites, browser fingerprinting, aggressive scareware, and legitimate remote desktop software to turn ordinary browsing sessions into opportunities for unauthorized access. The call ended after researchers questioned the installation, but no subsequent compromise was demonstrated in that specific test.

What should you do?

Security teams should monitor for unusual outbound connections to newly registered domains, particularly those hosted on free or disposable infrastructure like Cloudflare Pages. Organizations should review logs for attempts to install remote desktop software such as UltraViewer or TeamViewer, especially if initiated by users who report system errors. Users should be educated to recognize full-screen browser alerts that prevent closing tabs or accessing the task manager, as these are common indicators of tech support scams rather than genuine system failures.

What to do and how to stay safe: Help TDS

• Monitor network traffic for connections to newly registered domains, especially those using disposable hosting services like pages.dev.
• Train users to recognize browser-based full-screen alerts that prevent exiting the page, which are typical of tech support scams.
• Restrict the installation of remote desktop applications like UltraViewer or TeamViewer to authorized IT personnel only.
• Review web server logs for signs of compromised WordPress plugins or unusual redirects that may indicate traffic distribution system activity.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Help TDS?

Help TDS is a long-running traffic distribution system that directs users to tech support scams, currently linked to the Hotejka affiliate program.

How do attackers trick victims into calling support?

Attackers use full-screen browser manipulation, exit prevention techniques, and fake Microsoft warnings to pressure users into calling displayed support numbers.

Is there a patch for the woocommerce_inputs plugin?

The malicious woocommerce_inputs plugin is unrelated to legitimate WooCommerce software; it is a malicious tool injected by attackers into compromised sites.