Ethical Hacking News
Help TDS, a rebranded traffic monetization operation, has been linked to numerous instances of tech support scams. The operation's use of browser fingerprinting and location to determine the course of action for the victim is a significant concern. By understanding the operations and tactics of Help TDS, we can better equip ourselves to defend against similar threats in the future. This article provides a detailed look at the operation's history, tactics, and techniques, and serves as a warning to organizations and individuals alike to be vigilant in protecting themselves from such threats.
Help TDS, a rebranded traffic monetization operation, has been linked to numerous instances of tech support scams. The operation has been active since at least 2017 and has been linked to over 20,000 Cloudflare pages domains. Hotejka, a Russian-language affiliate program, is believed to be a rebrand of the now-defunct ROI777. The operation uses browser fingerprinting and location to determine the course of action for the victim. The TDS is believed to have paid its affiliates at least a few million dollars (USD) in recent years. The operation is connected to Hotejka and ROI777, with "roi777[.]com" being a historical C2 domain used between 2018 and 2020. About 20 different affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic to Help TDS.
The world of cybersecurity is often plagued by the ever-evolving threat landscape, where malicious actors and their tactics, techniques, and procedures (TTPs) are constantly adapting to evade detection. In recent times, a particular traffic distribution system (TDS) has emerged as a significant contributor to this ever-growing threat, and it's essential to shed light on its operations to prevent further exploitation. Meet Help TDS, a rebranded traffic monetization operation that has been linked to numerous instances of tech support scams.
Help TDS, initially known as Help TDS, has been active since at least 2017 and has been linked to over 20,000 Cloudflare pages domains. This web of deceit is designed to manipulate unsuspecting users into calling a Windows Support number, only to be asked to download and install a remote desktop tool, which, in reality, is a malicious software designed to provide unauthorized access to the victim's device. This type of scam is often referred to as a "tech support scam," and it has been observed to be a lucrative business for malicious actors.
The operation is believed to be linked to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of the now-defunct ROI777. Hotejka has been observed using a malicious WordPress plugin named "woocommerce_inputs" to steal WordPress user credentials and facilitate the malicious redirections. The plugin is injected into websites by Hotejka's affiliates, who range from spam operators to website compromisers.
The threat actor's use of browser fingerprinting and location to determine the course of action for the victim has been documented. The TDS functions akin to a relay, intercepting internet traffic from compromised websites, malicious ads, social media posts, or SEO spam, analyzing the visitor, filter traffic based on predefined criteria, and dynamically route them to scams, browser lockers, or malware drops.
Historical tracking of malicious redirect chains has uncovered that Help TDS has routinely handed off traffic directly to VexTrio Viper, a cybercrime operator that runs an affiliate program to enable scams, riskware, spyware, adware, and pornographic content. The connection between Hotejka and ROI777 is believed to be driven by the leak of data obtained from ROI777's servers in March 2018, around when it was operating Disposable TDS, a precursor to Help TDS.
In recent years, Hotejka has also been observed using different aliases on forums like CrackingX, seeking traffic from email spam and access to WordPress admin panels for prices starting at $100. The TDS has also been linked to over 300 disposable pages per day, with the threat actor creating approximately 20,000 domains since April 2026.
The rebrand is believed to be driven by the leak of data obtained from ROI777's servers in March 2018, around when it was operating Disposable TDS, a precursor to Help TDS. The published details included Telegram identities of its users and specifics about multiple campaigns. The connection between Hotejka and ROI777 doesn't end there, for GoDaddy also found that "roi777[.]com" was one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains.
"The connection between Hotejka and ROI777 doesn't end there," said Infoblox. "Their affiliates range from spam operators to website compromisers. Potential victims are redirected into the TDS from these affiliates via special URLs provided by Hotejka. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action."
The TDS is believed to be implemented on Keitaro, an advertising performance tracking platform that's known to be abused by various threat actors. Some of the initial Help TDS lures prompt users of an impending Windows update, followed by a warning that the machine has been disabled by Microsoft, tells them not to restart the computer, and that a "computer lock" has been put in place to block illegal activity.
The scareware prompt is designed to persuade the victim to contact the Microsoft Technical Support team. Should the victim make the phone call, the threat actor on the other end instructs them to download and install a free remote desktop tool like Ultraviewer to gain complete control of the infected machine. The fingerprinting step determines whether to route the user to either the tech support scam or to another affiliate marketing platform, which then evaluates the device again and resells the traffic.
"These pathways lead to scam landing pages with fake CAPTCHA checks to enroll the victim's browser to push-notification spam," said Infoblox. "Historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms give us a high degree of confidence that ROI777 and Hotejka are one and the same."
The rebranding of Help TDS to Hotejka is believed to be driven by the leak of data obtained from ROI777's servers in March 2018, around when it was operating Disposable TDS, a precursor to Help TDS. The connection between Hotejka and ROI777 is further solidified by the fact that "roi777[.]com" was one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains.
In all, about 20 different affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic to Help TDS. These operations are known to heavily target WordPress sites to redirect victims to scams and malware. According to Infoblox, "Hotejka/ROI777 has been loyal to the two affiliate platforms since 2017, and we believe that loyalty has paid handsomely."
The TDS is believed to have paid its affiliates at least a few million dollars (USD) in recent years. The operation's use of a malicious WordPress plugin to steal WordPress user credentials and facilitate the malicious redirections has been documented.
In recent years, Hotejka has also been observed using different aliases on forums like CrackingX, seeking traffic from email spam and access to WordPress admin panels for prices starting at $100. The TDS has also been linked to over 300 disposable pages per day, with the threat actor creating approximately 20,000 domains since April 2026.
The TDS is believed to be implemented on Keitaro, an advertising performance tracking platform that's known to be abused by various threat actors. Some of the initial Help TDS lures prompt users of an impending Windows update, followed by a warning that the machine has been disabled by Microsoft, tells them not to restart the computer, and that a "computer lock" has been put in place to block illegal activity.
The scareware prompt is designed to persuade the victim to contact the Microsoft Technical Support team. Should the victim make the phone call, the threat actor on the other end instructs them to download and install a free remote desktop tool like Ultraviewer to gain complete control of the infected machine. The fingerprinting step determines whether to route the user to either the tech support scam or to another affiliate marketing platform, which then evaluates the device again and resells the traffic.
"These pathways lead to scam landing pages with fake CAPTCHA checks to enroll the victim's browser to push-notification spam," said Infoblox. "Historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms give us a high degree of confidence that ROI777 and Hotejka are one and the same."
The operation's use of browser fingerprinting and location to determine the course of action for the victim has been documented. The TDS functions akin to a relay, intercepting internet traffic from compromised websites, malicious ads, social media posts, or SEO spam, analyzing the visitor, filter traffic based on predefined criteria, and dynamically route them to scams, browser lockers, or malware drops.
The connection between Hotejka and ROI777 is further solidified by the fact that "roi777[.]com" was one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains. In all, about 20 different affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic to Help TDS.
The operation's use of a malicious WordPress plugin to steal WordPress user credentials and facilitate the malicious redirections has been documented. The TDS is believed to have paid its affiliates at least a few million dollars (USD) in recent years.
The TDS is believed to be implemented on Keitaro, an advertising performance tracking platform that's known to be abused by various threat actors. Some of the initial Help TDS lures prompt users of an impending Windows update, followed by a warning that the machine has been disabled by Microsoft, tells them not to restart the computer, and that a "computer lock" has been put in place to block illegal activity.
The scareware prompt is designed to persuade the victim to contact the Microsoft Technical Support team. Should the victim make the phone call, the threat actor on the other end instructs them to download and install a free remote desktop tool like Ultraviewer to gain complete control of the infected machine. The fingerprinting step determines whether to route the user to either the tech support scam or to another affiliate marketing platform, which then evaluates the device again and resells the traffic.
"These pathways lead to scam landing pages with fake CAPTCHA checks to enroll the victim's browser to push-notification spam," said Infoblox. "Historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms give us a high degree of confidence that ROI777 and Hotejka are one and the same."
The TDS is a testament to the ever-evolving nature of cybersecurity threats. It's essential to stay vigilant and take proactive measures to protect ourselves and our organizations from such threats. By understanding the operations and tactics of Help TDS, we can better equip ourselves to defend against similar threats in the future.
In conclusion, Help TDS is a complex web of deceit that has been linked to numerous instances of tech support scams. Its use of browser fingerprinting and location to determine the course of action for the victim is a significant concern. The operation's use of a malicious WordPress plugin to steal WordPress user credentials and facilitate the malicious redirections has been documented. The TDS is believed to have paid its affiliates at least a few million dollars (USD) in recent years.
The operation's connection to Hotejka and ROI777 is further solidified by the fact that "roi777[.]com" was one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains. In all, about 20 different affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic to Help TDS.
The TDS is a significant concern for cybersecurity professionals and organizations alike. It's essential to take proactive measures to protect ourselves and our organizations from such threats. By understanding the operations and tactics of Help TDS, we can better equip ourselves to defend against similar threats in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Hidden-Dangers-of-Help-TDS-A-Web-of-Deceit-and-Deception-ehn.shtml
https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html
Published: Thu Oct 15 17:55:55 2026 by llama3.2 3B Q4_K_M
