Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam
Executive Summary
Since at least 2017, a Russian-language affiliate network called Hotejka has operated Help TDS, a malicious traffic distribution system that routes victims to Microsoft-impersonation tech support scams. Researchers at Infoblox infiltrated the affiliate panel and confirmed the platform serves over a dozen criminal affiliates—including known malware operations Balada Injector and DollyWay—redirecting compromised web traffic to fake Windows security alerts. Victims are socially engineered into installing remote desktop tools such as UltraViewer, granting threat actors persistent, repeated access to their systems. Over 20,000 malicious Cloudflare Pages domains were detected across a six-month period, with C2 infrastructure rolling over every five minutes via Telegram.
This operation illustrates how commodity social engineering infrastructure has industrialized at scale, combining legitimate CDN abuse, dark-web affiliate models, and remote access tooling to enable long-term victim exploitation far beyond simple credit card fraud.
Why This Matters Now
Tech support scam operations like Help TDS are no longer isolated nuisances—they are industrialized, affiliate-driven platforms capable of reaching thousands of enterprise endpoints daily. With C2 domains cycling every five minutes over Telegram, traditional domain-block lists and perimeter defenses fail. Organizations face persistent remote access compromise that enables living-off-the-land follow-on attacks, making egress control, anomaly detection, and zero trust segmentation critical defensive priorities heading into 2027.
Attack Path Analysis
The Help TDS operation begins with victim redirection through a malicious traffic distribution system that routes users hijacked from compromised WordPress sites or malvertising campaigns to fake Microsoft security alerts, tricking them into calling a fraudulent call center. Once victims are socially engineered into installing remote desktop tools such as UltraViewer, threat actors gain persistent remote access to victim machines, enabling repeated exploitation, credential harvesting, and financial fraud without deploying traditional malware payloads.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Victims are redirected through the Help TDS infrastructure via compromised WordPress sites (Balada Injector, DollyWay), malvertising, spam, or social media. The TDS fingerprints each visitor and routes qualifying targets to fake Microsoft Windows Security Center alerts hosted on Cloudflare Pages domains, generated at approximately 300 new domains per day using domain generation algorithms. Victims are shown browser-locking fake security warnings with voice-over instructions urging them to call a fraudulent Microsoft support number.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Link
Stage Capabilities: Link Target
Remote Access Software
Acquire Infrastructure: Domains
Impersonation
Application Layer Protocol: Web Protocols
Resource Hijacking
Masquerading: Match Legitimate Name or Location
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection and Spam Protection
Control ID: SI-3, SI-8
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Application-Level Trust Enforcement
Control ID: Network Pillar - Macro/Micro Segmentation, Application Pillar - Access Authorization
NIS2 Directive – Cybersecurity Risk Management and Incident Handling
Control ID: Article 21 - Security of Network and Information Systems
PCI DSS 4.0 – Anti-Phishing Controls and Security Awareness Training
Control ID: Requirement 5.4, Requirement 12.6
DORA (Digital Operational Resilience Act) – ICT Incident Detection and Third-Party Provider Risk Management
Control ID: Article 13 - ICT-related Incident Management, Article 28 - Third-Party Risk
NYDFS 23 NYCRR 500 – Cybersecurity Awareness Training and Incident Response
Control ID: Section 500.14 - Training and Monitoring, Section 500.16 - Incident Response Plan
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Tech support scams deploying remote access trojans via Help TDS expose financial services firms to credential theft, unauthorized account access, and lateral movement enabling large-scale fraud and data exfiltration.
Information Technology/IT
IT organizations face elevated risk as Help TDS abuses legitimate tools like UltraViewer and Cloudflare infrastructure, enabling living-off-the-land RAT attacks bypassing egress controls and anomaly detection systems.
Health Care / Life Sciences
Healthcare entities targeted by Microsoft-impersonation scams risk HIPAA violations under 164.312(e)(1) and 164.308(a)(6) when remote access trojans exfiltrate protected health data through unmonitored outbound channels.
Computer/Network Security
Security firms face reputational and operational risk as Help TDS actively fingerprints and filters out sandboxed environments, undermining threat detection baselines and incident response per NIST.800-53.IR-5 compliance requirements.
Sources
- Researchers Infiltrate Microsoft Tech Support Scam Operationhttps://www.darkreading.com/threat-intelligence/microsoft-tech-support-scam-operationVerified
- Infoblox Threat Intelligence: Help TDS and Hotejka Affiliate Networkhttps://blogs.infoblox.com/threat-intelligence/Verified
- CISA: Recognizing and Avoiding Tech Support Scamshttps://www.cisa.gov/news-events/news/recognizing-and-avoiding-tech-support-scamsVerified
- FTC Consumer Advice: Tech Support Scamshttps://consumer.ftc.gov/articles/tech-support-scamsVerified
- GoDaddy Security Research: Malicious WordPress Plugin Abusehttps://www.godaddy.com/resources/news/security-researchers-malicious-wordpress-pluginsVerified
- Keitaro TDS Platform Abuse by Threat Actorshttps://keitaro.io/
- Cloudflare Pages Abuse in Phishing and Malware Campaignshttps://blog.cloudflare.com/cloudflare-pages-is-now-generally-available/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the Help TDS operation relies on uncontrolled outbound access and unrestricted east-west reachability to complete credential harvesting and exfiltration through remote desktop sessions. By enforcing segmented workload boundaries and controlled egress paths, CNSF would likely reduce the attacker's ability to pivot across internal resources and exfiltrate data freely from compromised endpoints.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Outbound connections from workloads to newly registered or uncategorized Cloudflare Pages domains could likely be constrained, reducing the reachability of TDS redirect infrastructure from within managed cloud environments and limiting how many internal workloads are exposed to the initial lure delivery mechanism.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely constrain the scope of access available to a remotely controlled session, limiting which internal resources the operator-controlled endpoint can reach based on identity-scoped access rules rather than broad network adjacency.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to traverse from the initially compromised endpoint to adjacent workloads, shared drives, or domain-joined resources, constraining how far the remote desktop operator can propagate across the internal environment.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls could likely surface anomalous outbound connection patterns to high-frequency domain rotations or abuse of legitimate CDN infrastructure, reducing the operational effectiveness of rapidly rotating C2 channels by flagging or constraining those communication paths from managed workloads.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely constrain unauthorized outbound data transfers initiated through remote desktop sessions, reducing the volume and scope of sensitive data that can be moved out of the environment over uncontrolled outbound paths during an active operator session.
Even where initial remote access is achieved through social engineering, earlier CNSF segmentation and egress constraints would likely reduce the blast radius of the operation by limiting how many internal assets, credentials, or downstream accounts remain reachable from the compromised endpoint, narrowing the total scope of financial and identity-related harm.
Impact at a Glance
Affected Business Functions
- End-User Device Security and Integrity
- Remote Access and Identity Verification
- Financial Fraud Prevention and Consumer Protection
- Corporate IT Help Desk and Support Operations
Estimated downtime: N/A
Estimated loss: N/A
Individual victims who comply with scam instructions are subjected to full remote access to their personal or corporate Windows devices via UltraViewer or similar remote desktop tools. This exposes sensitive data categories including: stored credentials and passwords, banking and financial account information, personal identifiable information (PII), corporate email and document repositories accessible from the compromised endpoint, and browser-saved session tokens. Repeated victimization is explicitly noted as the threat actor's goal, enabling ongoing data harvesting, fraudulent financial transactions, and potential lateral movement into corporate networks if the victim's device is enterprise-connected. At scale, the Help TDS affiliate model and over 20,000 Cloudflare Pages domains detected in six months suggest thousands of potential victims across consumer and enterprise segments globally.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement with FQDN filtering to block outbound connections to known remote desktop tool download domains (e.g., ultraviewer.net, anydesk.com) and dynamically generated Cloudflare Pages C2 domains, preventing victims or endpoints from fetching RAT installers or communicating with rotating C2 infrastructure.
- • Implement Multicloud Visibility & Control with anomaly detection baselining to flag and alert on unusual outbound traffic patterns consistent with remote desktop tool installation events, rapid C2 domain rotation (hundreds of new FQDN connections per day), and Telegram-based C2 channel usage from corporate endpoints.
- • Apply Cloud Firewall (ACF) with URL filtering and AI-driven traffic discovery to identify and block access to the approximately 300 newly generated Cloudflare Pages domains created daily by Help TDS domain generation algorithms, using threat intelligence feeds and pre-emptive domain reputation scoring to disrupt redirection infrastructure before victims reach fake alert pages.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policy to restrict which endpoints are permitted to initiate remote desktop sessions or download and execute remote access tools, ensuring that even if a user is socially engineered, microsegmentation policies prevent the installed RAT from reaching sensitive internal resources or pivoting to adjacent systems.
- • Leverage Threat Detection & Anomaly Response with remote access detection capabilities to continuously monitor for the deployment of covert or unsanctioned remote access tools such as UltraViewer and AnyDesk on endpoints, trigger automated incident response workflows upon detection, and correlate Telegram C2 domain resolution events with endpoint behavior to identify compromised victims before repeated exploitation occurs.
