In a significant cybersecurity breach, hackers have leveraged over 20,000 Cloudflare Pages domains over the past six months to disseminate fraudulent Microsoft security alerts. This orchestrated campaign aims to divert unsuspecting users to fraudulent call centers.
The operation employs a system known as Help Traffic Distribution System (Help TDS), which redirects traffic from compromised websites, malicious advertisements, social media posts, and spam emails to tech support scams. Victims encounter alarming messages claiming their computers have been disabled by Microsoft, accompanied by loud alerts and a fake support number.
The Mechanics of the Scam
Once users are ensnared, their browsers appear locked, coercing them to call a supposed Microsoft technician. The scam’s objective is to gain remote access to the victim’s computer rather than merely extracting payment for bogus repairs.
Research by Infoblox has traced the malware-driven operation to Hotejka, a Russian-language affiliate program. Their findings, published on October 15, connect Hotejka to ROI777 through historical DNS records and shared infrastructure, with the operation dating back to at least April 2017.
Technical Details and Affiliations
Help TDS meticulously checks visitors’ browser details and location before determining the appropriate redirection path. Selected users are confronted with simulated update notifications followed by Microsoft-branded warnings. Prior reports have described how malicious PHP templates and WordPress plugins transform legitimate sites into gateways for similar scams.
Infoblox’s June 2026 investigation into a call center involved in the scam revealed operators posing as Microsoft Technical Support. They inquired about the ownership of the computer and guided the installation of UltraViewer, a legitimate tool that attackers misuse for unauthorized access.
Infrastructure and Preventative Measures
Since April 2026, the group orchestrating this scam has utilized temporary Cloudflare Pages for hosting their TDS and scam sites, with approximately 300 new domains announced daily via Telegram. Notably, these figures represent attacker-created infrastructure rather than compromised Cloudflare customer accounts.
Infoblox has identified around 20 affiliates, including Balada Injector, Detour Dog, and DollyWay, linking website infections to the scam network. Their detection models can identify related domains up to seven days prior to their deployment, significantly reducing exposure among their cloud customers.
To counter these threats, it is crucial to update defenses against emerging malware promptly and integrate threat intelligence feeds with data from security operations centers.
