Help TDS Tied to Hotejka Affiliate Program Behind 20,000+ Cloudflare Pages Tech Support Scams

A long-running Traffic Distribution System (TDS) known as Help TDS has been linked to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. According to a report published by The Hacker News, Help TDS is assessed to have been active since at least 2017. The operation offers PHP code templates to partners and affiliates, which are installed into compromised websites with the aim of directing unsuspecting visitors to tech support scams.

The TDS infrastructure functions by routing traffic from compromised websites or directly from Cloudflare Pages domains to tech support scam pages. These scams typically display false warnings about computer viruses or security issues, urging users to call a fraudulent technical support line. Victims who call may be subjected to financial fraud, tricked into installing remote access trojans, or persuaded to pay for unnecessary software repairs.

The report indicates that over 20,000 Cloudflare Pages domains are currently hosting these tech support scams associated with the Help TDS/Hotejka infrastructure. The use of Cloudflare Pages allows the scam operators to leverage the legitimate cloud hosting platform's reputation and infrastructure to host malicious content, potentially evading some security filters.

Help TDS has been assessed as active since at least 2017, making it a long-standing threat in the tech support scam ecosystem. The rebranding to Hotejka suggests the operators are attempting to maintain continuity while potentially evading detection or scrutiny from security researchers and law enforcement.

The exact methodology of how the PHP templates are deployed to Cloudflare Pages domains is not detailed in the report, but the implication is that affiliates are compromising websites or abusing the platform to host the redirect templates. The global reach of the operation means visitors from various regions may be affected, though the affiliate program appears to have a Russian-language focus.