"Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," Infoblox said in a report shared with The Hacker News.
Help TDS, Hotejka, and ROI777: a documented lineage
Security researchers tie a long-running Traffic Distribution System (TDS) called Help TDS to a Russian-language affiliate program named Hotejka, which appears to be a rebrand of a traffic monetization operation known as ROI777. Infoblox assesses Help TDS has been active since at least 2017. Guardicore Labs (now part of Akamai) previously exposed ROI777 in June 2018 in connection with Operation Prowli, a campaign that combined server compromise, a cryptocurrency-mining malware called r2r2, and traffic monetization fraud.
Infoblox and historical records show continuity between ROI777 and Hotejka: Infoblox cites consistent command-and-control (C2) mechanisms and loyal use of the same affiliate platforms since 2017. GoDaddy's August 2025 analysis also found the historical C2 domain roi777[.]com among domains used between 2018 and 2020 to fetch redirect destinations.
Technical playbook: WordPress plugin, Keitaro, and browser fingerprinting
GoDaddy documented the TDS's evolution, identifying a malicious WordPress plugin named "woocommerce_inputs" used on thousands of sites to steal WordPress credentials and enable redirections. Affiliates inject the plugin or alternatively a custom HTML block, which fetches redirect URLs from the TDS's C2 servers.
Help TDS operates like a routing relay. It evaluates incoming visitors via browser fingerprinting and location checks — looking at geographic location, device metadata, IP reputation, and whether the client is a headless browser — and dynamically routes traffic to scams, browser lockers, or other affiliate platforms. Infoblox said the TDS is believed to be implemented on Keitaro, an advertising performance-tracking platform that has been abused by multiple threat actors.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScams, call centers, and the mechanics of compromise
The redirected landing pages present full-screen browser manipulation and exit-prevention techniques, serving bogus Microsoft Windows alert screens that tell users not to restart and instruct them to contact a Windows Support number. If victims call, operators use social engineering to persuade them to install free remote desktop tools such as Ultraviewer, granting the attackers persistent remote access. "It's not simple credit card fraud: it's remote access, living-off-the-land malware operations," Infoblox said, noting that once an attacker is in they can "exploit the victim time and again."
Help TDS has also routinely handed off traffic directly to VexTrio Viper, an affiliate operator that runs programs for scams, riskware, spyware, adware, and pornographic content. Other affiliates named by Infoblox include Balada Injector, Detour Dog, and DollyWay; in total, Infoblox observed about 20 different affiliates sending traffic into Help TDS. Affiliates range from spam operators to website compromisers, and historically have targeted WordPress sites heavily to funnel victims into the TDS.
Cloudflare Pages abuse: scale and disposability
Since April 2026, the campaign shifted to free Cloudflare Pages sites (*.pages[.]dev). The threat actor created roughly 300 disposable pages per day, and researchers detected more than 20,000 such domains in that period. The rapid, disposable nature of those pages is consistent with an affiliate model that needs many short-lived landing domains to avoid takedown and continuously route traffic.
Hotejka also advertises its services publicly: messages on its Telegram channel @hotejka_hot promote forced browser extension installations and tech-support landing pages described as "very difficult to exit." In a post dated July 17, the operator claimed a "small call center in Germany will handle 50-100 calls per day," underscoring the human infrastructure behind the automated redirection pipeline.
What this means for technologists, end users, and platform operators
- Technologists and security teams should monitor for the "woocommerce_inputs" plugin or unexpected custom HTML blocks in WordPress sites, watch for C2 indicators such as roi777[.]com and similar domains, and investigate unusual outbound fetches from site administration pages. The TDS's Keitaro-based routing and fingerprinting behaviors are key detection signals.
- End users should treat full-screen Windows-style lock or alert pages with extreme suspicion, avoid calling numbers presented on those screens, and refuse requests to install remote desktop tools from unverified callers. The social-engineering step — persuading victims to install a remote-access tool — is central to the threat's persistence.
- Platform providers and hosting services should be aware that free, disposable hosting (e.g., Cloudflare Pages *.pages[.]dev) can be abused at scale: the campaign generated roughly 300 pages per day and more than 20,000 domains since April 2026, a pattern that complicates takedown and incident response.
Across nearly a decade of activity, the operators behind Help TDS/Hotejka have combined technical routing, affiliate incentives, and human call-center operations into a resilient fraud ecosystem. Infoblox's analysis — coupled with GoDaddy's plugin findings and Guardicore's historical exposure of ROI777 — paints a picture of a profitable, evolving illicit business: Infoblox suspects the two European programs have paid the operators "at least a few million dollars (USD)." The central question left by these facts is whether defenders can keep pace with an operation that mixes disposable infrastructure, automated fingerprinting, and real-world call centers.
https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html
