Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts
Attackers used over 20,000 Cloudflare Pages domains to push fake Microsoft alerts into tech-support scams.
Infoblox says criminals abused more than 20,000 Cloudflare Pages domains over six months to deliver fake Microsoft security alerts and tech-support scams. Help TDS sends selected visitors from compromised sites, malicious ads, social media, and spam to pages that lock the browser, sound alarms, and show a fake support number. In a June 2026 test, an operator claiming to be Microsoft support directed researchers to install UltraViewer for remote access. Researchers attribute the operation to the Russian-language Hotejka affiliate program, link it to ROI777, and name affiliates including Balada Injector, Detour Dog, and DollyWay; about 300 new domains were announced daily on Telegram.