Help TDS and Hotejka Orchestrate Massive Tech Support Scam Operations
Over 20,000 Cloudflare Pages domains facilitate sophisticated browser-based social engineering and remote access fraud.
1Evolution of Help TDS
Help TDS has operated since 2017, functioning as a routing infrastructure for tech support scams. Originally linked to the ROI777 operation exposed in 2018, it rebranded following a 2018 data leak. The system now powers the Hotejka affiliate program, utilizing PHP templates and malicious WordPress plugins to redirect unsuspecting users toward fraudulent activities.
2Mechanism of Traffic Redirection
The system acts as a relay, intercepting traffic from compromised websites or malicious advertisements. By employing browser fingerprinting and location analysis, it dynamically routes visitors to specific landing pages. This infrastructure leverages Keitaro, an advertising performance platform, to filter traffic based on device metadata, IP reputation, and the presence of headless browsers.
3Social Engineering Tactics
Victims encounter full-screen browser manipulation displaying fake Microsoft security alerts. These prompts warn of illegal activity and disable computer functions, urging users to call a support number. Once contact is established, operators use social engineering to convince victims to install remote desktop tools like Ultraviewer, granting attackers complete control over the machine.
4Scale of Cloudflare Abuse
Since April 2026, the threat actors have aggressively utilized Cloudflare Pages to host scam content. By generating approximately 300 disposable domains daily, they have successfully deployed over 20,000 unique sites. This strategy allows them to maintain persistence while evading detection, as the infrastructure remains highly ephemeral and difficult for traditional security filters.
5Affiliate Network Dynamics
Hotejka manages a network of roughly 20 affiliates, including groups like Balada Injector and Detour Dog. These partners provide traffic through email spam, SEO manipulation, and compromised WordPress admin panels. Hotejka incentivizes these actors by offering specialized URLs and payout structures, fostering a collaborative ecosystem that has generated millions of dollars since 2017.
6Historical C2 Infrastructure
Evidence linking Hotejka to the legacy ROI777 operation includes consistent command-and-control mechanisms and shared domain usage. Historical DNS records indicate that domains like roi777.com were active C2 points between 2018 and 2020. This continuity demonstrates a long-term commitment to specific affiliate advertising platforms, which has remained a core pillar of their business model.
7Operational Intent and Reach
Communication on the Hotejka Telegram channel confirms their intent to maximize victim engagement through forced browser extensions and persistent landing pages. A July 2026 post highlighted a call center in Germany capable of handling 100 calls daily. This indicates a structured, professionalized approach to scamming that extends beyond simple automated credit card fraud.
8Implications for Web Security
The persistence of Help TDS highlights the dangers of living-off-the-land malware operations and the exploitation of legitimate hosting services. By leveraging trusted platforms like Cloudflare and WordPress, attackers bypass standard security perimeters. Organizations must prioritize runtime identity controls and rigorous monitoring of traffic patterns to defend against these evolving, highly profitable cybercrime affiliate programs.