Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

This is a long-running operation with a fresh wave of infrastructure abuse. The scale of the Cloudflare Pages abuse is notable.

Help TDS (Hotejka / ROI777) has been active since at least 2017, using compromised websites and now Cloudflare’s own Pages service to redirect victims to tech support scams and affiliate fraud pages. The group provides PHP templates to affiliates, which are injected into legitimate sites to perform traffic routing based on geolocation, device type, and referrer headers.

Technical Breakdown: – TTPs: – T1090 (Proxy): TDS acts as a traffic broker, hiding the final scam destination. – T1190 (Exploit Public-Facing Application): Initial compromise of legitimate sites to host the PHP TDS templates. – T1583.003 (Acquire Infrastructure: Virtual Private Server): Abuse of Cloudflare Pages for hosting redirector domains. – IOCs: – Scale: Over 20,000 Cloudflare Pages subdomains identified. – Affiliate Program: Hotejka (rebrand of ROI777). – Delivery: PHP code templates injected into compromised web servers. – Targeting: Victims are filtered by IP geolocation, browser language, and device type before being sent to the final scam page (e.g., fake Microsoft/Apple support alerts).

Defense: – For defenders: Monitor for unexpected .pages.dev subdomains in your proxy logs or DNS queries. Block known TDS domains at the network perimeter. – For site owners: Audit your web root for unauthorized PHP files, particularly those with obfuscated redirect logic.

Source: https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html