Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts
Attackers used over 20,000 Cloudflare Pages domains to push fake Microsoft alerts into tech-support scams.
74
Product
UltraViewer
- Mentions · 7d0
- Mentions · 30d3
- All mentions4
- First seenSep 7, 2026
- Last mentioned14d ago
Timeline
4 articles · newest firstResearchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams
Infoblox found over 20,000 Cloudflare Pages domains used by Help TDS for Microsoft tech-support scams.
62
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
Infoblox ties Help TDS to Hotejka as over 20,000 Cloudflare Pages domains push tech-support scams.
68
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
66
Appears with
- Microsoftvendor · 3
- Cloudflare Pagesproduct · 3
- ROI777threat actor · 3
- Infobloxorganization · 3
- Hotejkathreat actor · 3
- Cloudflarevendor · 3
- WordPressproduct · 3
- Help TDSthreat actor · 2
- GoDaddyvendor · 2
- GoDaddyorganization · 2
- Quick Assistproduct · 1
- Balada Injectormalware · 1
- Cloudflareorganization · 1
- r2r2malware · 1
- Huntressorganization · 1
- Akamaiorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.