Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
Summary: A long-running traffic distribution system called Help TDS has been linked to a Russian-language affiliate program called Hotejka, which Infoblox assesses is a rebrand of the ROI777 traffic monetization operation, with Help TDS active since at least 2017. Since April 2026 the scams have run on free Cloudflare Pages sites, with roughly 300 disposable pages created per day and over 20,000 such domains detected, routing victims through browser fingerprinting to fake Microsoft security alerts that push them to call a support number and install remote desktop tools like Ultraviewer.
Bottom line: About 20 affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic into Help TDS, and Infoblox estimates the two European programs behind it have paid out at least a few million dollars over eight years of operation.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026