Help TDS Exploits 20,000+ Cloudflare Pages for Massive Tech Support Scam Campaign
Executive Summary
Help TDS, a long-running Traffic Distribution System active since 2017, has been linked to the Russian-language affiliate program Hotejka, suspected to be a rebrand of ROI777. The operation compromises websites to redirect users to tech support scams using browser manipulation techniques and fake Microsoft security alerts. Since April 2026, attackers have leveraged over 20,000 Cloudflare Pages domains, creating approximately 300 disposable pages daily to evade detection while directing victims to call centers where social engineers convince them to install remote access tools.
This incident highlights the evolving threat landscape where traditional scams are becoming more sophisticated, leveraging legitimate cloud infrastructure and automated traffic distribution systems. The operation's eight-year persistence and estimated multi-million dollar revenue demonstrate how cybercriminals are professionalizing affiliate-based fraud models, making detection and prevention increasingly challenging for organizations.
Why This Matters Now
The massive scale of 20,000+ compromised Cloudflare Pages domains and the evolution from simple credit card fraud to persistent remote access operations represents a critical escalation in tech support scam sophistication, requiring immediate attention to cloud infrastructure abuse and traffic filtering controls.
Attack Path Analysis
Help TDS operators executed a multi-stage attack leveraging compromised WordPress sites for initial access, escalating through malicious plugin installation and credential theft, establishing persistent command and control infrastructure through Cloudflare Pages domains, and ultimately redirecting victims to tech support scams for financial fraud and remote access installation.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers compromised WordPress websites through vulnerabilities and installed malicious woocommerce_inputs plugin to establish initial foothold on victim sites
MITRE ATT&CK® Techniques
Phishing: Spearphishing Link
Drive-by Compromise
Server Software Component: Web Shell
Acquire Infrastructure: Domains
Credentials from Password Stores
Remote Access Software
Impersonation
Remote System Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing
Control ID: 500.15
DORA – ICT Third-party Risk Management
Control ID: Article 11
CISA ZTMM 2.0 – Asset Management
Control ID: IDP.AM.1
NIS2 Directive – Incident Handling
Control ID: Article 21(2)(a)
ISO 27001:2022 – Separation in Networks
Control ID: A.8.31
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Internet
Help TDS exploits compromised websites and Cloudflare Pages domains for tech support scams, directly targeting internet infrastructure and web services through traffic distribution systems.
Computer Software/Engineering
WordPress plugins and CMS vulnerabilities enable malicious redirections, while remote desktop tools facilitate unauthorized access requiring enhanced egress security and threat detection capabilities.
Telecommunications
Tech support scam call centers exploit telecommunications infrastructure to social engineer victims into installing remote access tools, compromising network security and customer trust.
Financial Services
Remote desktop access from tech support scams enables persistent financial fraud, requiring zero trust segmentation and encrypted traffic monitoring to prevent unauthorized transactions.
Sources
- Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scamshttps://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.htmlVerified
- Inside Help TDS, Hotejka, Cloudflare Pages, and Predictive Detectionhttps://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/Verified
- Help TDS: Malicious Plugins Redirect to Tech Support Scamshttps://www.godaddy.com/resources/news/help-tds-malicious-plugins-redirect-tech-support-scamsVerified
- Operation Prowli: Traffic Manipulation and Cryptocurrency Mininghttps://www.akamai.com/blog/security/operation-prowli-traffic-manipulation-cryptocurrency-miningVerified
- Cloudflare Pages and Workers Domains Increasingly Abused for Phishinghttps://www.fortra.com/blog/cloudflare-pages-workers-domains-increasingly-abused-for-phishingVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained this Help TDS campaign by limiting lateral movement between compromised WordPress sites and restricting outbound communications to dynamically generated Cloudflare Pages domains.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust segmentation would likely have isolated compromised WordPress sites, reducing the blast radius and limiting attackers' ability to leverage the initial compromise for broader network reconnaissance.
Control: Zero Trust Segmentation
Mitigation: Workload isolation policies would likely have limited the scope of credential harvesting by restricting plugin access to only necessary administrative resources rather than broad system-level privileges.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have constrained lateral spread by blocking unauthorized communications between WordPress sites, significantly reducing the operators' ability to expand their affiliate network compromise footprint.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility would likely have detected and constrained the high-volume generation of Cloudflare Pages domains, limiting attackers' ability to maintain distributed C2 infrastructure across cloud platforms.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely have constrained data exfiltration by blocking unauthorized outbound communications containing victim fingerprinting data, reducing the scope of traffic monetization capabilities.
While CNSF controls would likely have reduced the scale and reach of victim redirections, compromised endpoints installing Ultraviewer would still face residual exposure to financial fraud operations.
Impact at a Glance
Affected Business Functions
- Website Operations and Content Management
- Customer Trust and Brand Reputation
- Digital Marketing and Traffic Monetization
- Customer Support and Service Delivery
Estimated downtime: N/A
Estimated loss: N/A
Compromised WordPress credentials from thousands of websites, user browsing data and device fingerprints collected through malicious redirections, and potential victim personal information obtained through tech support scams including remote desktop access to infected machines
Recommended Actions
Key Takeaways & Next Steps
- • Implement Cloud Firewall (ACF) with URL filtering to block malicious redirect domains and prevent traffic distribution to scam sites
- • Deploy Multicloud Visibility & Control to detect anomalous traffic patterns and repeated malformed requests indicative of TDS activity
- • Enable Egress Security & Policy Enforcement to prevent unauthorized outbound connections to C2 infrastructure and block data exfiltration
- • Implement Inline IPS (Suricata) to detect and block known exploit patterns targeting WordPress vulnerabilities and malicious payload delivery
- • Deploy Zero Trust Segmentation to limit lateral movement between compromised websites and prevent credential reuse across multiple properties
