Help TDS Scams Tied to Hotejka and Cloudflare Pages

Infoblox ties Help TDS tech-support scams to Hotejka, using more than 20,000 Cloudflare Pages domains since April 2026.

Infoblox links the long-running Help TDS traffic-distribution system to Hotejka, which it assesses is a rebrand of ROI777; one source also ties ROI777 to Operation Prowli and the r2r2 miner, while accounts differ on whether “at least 2017” dates Help TDS or ROI777 and Hotejka. Affiliates reach selected visitors through compromised WordPress sites using the malicious plugin woocommerce_inputs or HTML blocks, as well as malvertising, spam, social media, and Telegram; the plugin steals credentials and retrieves redirect URLs from command-and-control, and GoDaddy previously tied it to more than 10,000 sites. After browser and location fingerprinting, visitors see full-screen fake Windows security alerts, also described as fake Microsoft lock screens or alerts that lock the browser and sound alarms, then are pressured to call a support number. In a June 2026 test call, an operator impersonating Microsoft support told researchers to install UltraViewer, spelled Ultraviewer in one report. Since April 2026 the lures have used free Cloudflare Pages, with more than 20,000 domains over six months and about 300 new pages announced daily; one report says exposure later fell toward 0.5 percent, and sources call this trusted-hosting abuse rather than a disclosed Cloudflare vulnerability. The newest account adds that about 20 affiliates, including Balada Injector, Detour Dog, and DollyWay, feed traffic.

• Infoblox links Help TDS to the Russian-language Hotejka affiliate program, assessed as a rebrand of ROI777; sources date the activity to at least 2017, with one tying ROI777 to Operation Prowli and the r2r2 miner.
• Since April 2026, over six months, more than 20,000 Cloudflare Pages domains hosted the lures, with about 300 new pages a day.
• Affiliates use the WordPress plugin woocommerce_inputs or HTML blocks, plus malvertising, spam, social media, and Telegram; GoDaddy previously tied the plugin to more than 10,000 compromised sites.
• After browser and location fingerprinting, victims see full-screen fake Windows or Microsoft security alerts and are pushed to install UltraViewer (also spelled Ultraviewer); a June 2026 test call used a Microsoft-support impersonation.
• The newest report names about 20 affiliates feeding traffic, including Balada Injector, Detour Dog, and DollyWay.
• Sources describe abuse of trusted Cloudflare Pages hosting, not a disclosed Cloudflare vulnerability; one report says later exposure fell toward 0.5 percent.