Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
Infoblox ties Help TDS to Hotejka as over 20,000 Cloudflare Pages domains push tech-support scams.
Infoblox links the long-running Help TDS traffic-distribution system to the Russian-language affiliate program Hotejka, which it assesses is a rebrand of ROI777, previously tied to Operation Prowli and the r2r2 miner. Affiliates plant a malicious WordPress plugin, woocommerce_inputs, or HTML blocks on compromised sites to steal credentials and redirect visitors, after browser fingerprinting, to full-screen fake Windows security alerts. Call-center operators then persuade victims to install remote-access tools such as Ultraviewer. Since April 2026 the lures have run on free Cloudflare Pages sites, with roughly 300 new pages a day and more than 20,000 domains observed.