Help TDS Linked to Hotejka Affiliate Program, Over 20,000 Cloudflare Pages Domains Host Tech Support Scams

Help TDS and Hotejka Connection

Help TDS, a traffic distribution system active since at least 2017, has been connected to Hotejka, a Russian-language affiliate program. Hotejka is believed to be a rebrand of ROI777, a traffic monetization operation previously documented by Guardicore Labs in 2018.

Tech Support Scam Operations

Help TDS provides PHP code templates to partners who install them on compromised websites. These templates redirect users to tech support scams that display fake Microsoft Windows security alerts. Victims are instructed to call a support number, where social engineering is used to convince them to install remote desktop tools, allowing threat actors persistent access.

Infoblox reported that these are not simple credit card frauds, but rather remote access operations that can exploit victims repeatedly.

Infection Vectors and Scale

The operation utilizes malicious WordPress plugins, such as 'woocommerce_inputs', or custom HTML blocks injected into sites by Hotejka's affiliates. These tools steal WordPress user credentials and facilitate malicious redirections by fetching URLs from command-and-control servers. Over 20,000 Cloudflare Pages domains are currently hosting these tech support scams.

Historical Links to Cybercrime

Help TDS has historically handed off traffic directly to VexTrio Viper, another cybercrime operator running an affiliate program for various scams, riskware, spyware, adware, and pornographic content. The suspected predecessor, ROI777, was involved in compromising vulnerable servers to deploy malware for cryptocurrency mining and exploiting WordPress sites for traffic monetization fraud.