Severity: High | Priority: 1
Help TDS is a traffic distribution system that sends users to tech support scams run from call centres. Callers are talked into installing remote desktop tools, which gives the attackers ongoing access to their machines. Infoblox attributes it to Hotejka, a small Russian-language affiliate program that appears to be a rebrand of ROI777.
Users reach it through compromised websites, malvertising, social media posts and spam. The scam shows a fake update notice, then a full-screen “disabled by Microsoft” lock with alarms and a phone number. When Infoblox researchers called the number, the caller pretending to be Microsoft asked them to install the UltraViewer remote desktop tool. Since April 2026 the scam pages have been hosted on free Cloudflare Pages sites (pages.dev), with hundreds of new ones created every day.
If an alert is raised for a user device, first identify the actual client. If the source is your internal DNS server, use its query logs to find which machine made the request. Then speak to the user. If they saw a lock screen but did not call the number, close the browser through Task Manager, clear the browser’s site data and notification permissions, and run a scan.
If the user called the number or allowed anyone to connect, treat the machine as compromised. Disconnect it from your network and look for remote access tools such as UltraViewer, AnyDesk or TeamViewer that were installed recently. Reset the user’s passwords from a separate clean device, and check for unusual sign-ins or financial activity. If the machine has a sensitive role, rebuild it.
If the source of an alert is one of your web servers, especially a WordPress site, the server is likely compromised and is fetching current scam domains on behalf of an affiliate. Inspect it for injected PHP or HTML blocks and unknown plugins. The woocommerce_inputs plugin has previously been linked to this campaign. Remove the injected code, update the CMS and all plugins, and rotate the admin and database credentials.
If an alert reports a domain redirecting to hotcname.help, someone on your network visited a scam domain. Treat it the same way as a user-device alert.