Security · Updated 15 Oct, 07:41 pm IST
Help TDS linked to Hotejka used to host tech‑support scams on Cloudflare Pages
Why it matters for readers: It explains how browser‑locking pages and social engineering are used to trick people into giving attackers remote access.
- Help TDS is a long‑running TDS active since at least 2017 that delivers tech support scams via malicious redirections.1
- Researchers link Help TDS to a Russian‑language affiliate program called Hotejka, which appears to be a rebrand of ROI777.1
- Over 20,000 Cloudflare Pages domains have been observed hosting these scam pages that use full‑screen browser manipulation and exit prevention.1
- Affiliates install PHP templates, a malicious WordPress plugin named "woocommerce_inputs," or custom HTML blocks into compromised sites to fetch redirect URLs from C2 servers.1
- Victims are directed to call centers where social engineering convinces them to install remote desktop tools, enabling persistent access and further exploitation.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started