The **Help TDS** system, active since at least 2017, provides PHP code templates to its partners and affiliates. These templates are then injected into compromised websites, redirecting users to deceptive tech support scam pages. These pages often employ full-screen browser manipulation and exit prevention techniques to display fake **Microsoft Windows** security alerts, urging victims to contact a bogus "Windows Support" number. ## Beyond Simple Fraud: Remote Access and Persistent Exploitation **Infoblox**, in a recent report, highlighted the severe nature of these scams. "**Help TDS** delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," stated **Infoblox**. "It's not simple credit card fraud: it's remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again." ## The Evolution and WordPress Connection **GoDaddy** previously documented the evolution of **Help TDS** in August 2025 (sic), detailing the use of a malicious **WordPress** plugin named "woocommerce_inputs" across thousands of websites. This plugin was used to steal **WordPress** user credentials and facilitate malicious redirections by fetching URLs from **Help TDS**'s command-and-control (C2) servers. Affiliates of **Hotejka** inject this plugin, or a custom HTML block, into compromised sites. Historical analysis of malicious redirect chains also reveals that **Help TDS** has frequently handed off traffic directly to **VexTrio Viper**, a prominent cybercrime operator that runs an affiliate program for various scams, riskware, spyware, adware, and pornographic content. ## Linking Hotejka to ROI777 and Operation Prowli The latest findings firmly connect **Help TDS** to **Hotejka**, which is strongly suspected to be a successor to **ROI777**. **ROI777** was exposed by **Guardicore Labs** (now part of **Akamai**) in June 2018 in connection with "**Operation Prowli**," a campaign involving traffic manipulation and cryptocurrency mining. **Operation Prowli** compromised vulnerable servers to deploy malware named "r2r2" for cryptocurrency mining. Simultaneously, **WordPress** and other Content Management System (CMS) sites were exploited for traffic monetization fraud. "Traffic monetizers, such as **ROI777**, buy traffic from 'website operators' such as the **Prowli** attackers and redirect it to domains on demand," **Guardicore Labs** noted at the time. "Website 'operators' earn money per traffic sent through **roi777**. The destination domains frequently host different scams, such as fake services, malicious browser extensions and more." ## The Rebranding Imperative The rebrand from **ROI777** to **Hotejka** is believed to have been prompted by a data leak in March 2018, which exposed details from **ROI777**'s servers, including **Telegram** identities of its users and specifics about multiple campaigns. At the time, **ROI777** was operating **Disposable TDS**, a precursor to **Help TDS**. Further solidifying the connection, **GoDaddy** found that "roi777[.]com" was one of the historical C2 domains used between 2018 and 2020 to fetch redirect domains for the operation. ## How the TDS System Operates "[**Hotejka**'s] affiliates range from spam operators to website compromisers," **Infoblox** explained. "Potential victims are redirected into the TDS from these affiliates via special URLs provided by **Hotejka**. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action."  A Traffic Distribution System acts as a sophisticated relay, intercepting internet traffic from various sources like compromised websites, malicious ads, social media posts, or SEO spam. It analyzes visitors based on criteria such as geographic location, device metadata, IP reputation, and headless browsers, then dynamically routes them to specific scams, browser lockers, or malware drops. "**Help TDS** and its precursors are the routing decision infrastructure for a small affiliate program," **Infoblox** elaborated. "Other threat actors, for example ones who have compromised websites, send potential victim traffic to the TDS through specially crafted URLs." ## Abusing Legitimate Platforms and Social Engineering The **Help TDS** infrastructure is believed to be implemented on **Keitaro**, an advertising performance tracking platform frequently abused by threat actors. Initial lures often involve fake **Windows** update prompts, followed by warnings that the machine has been disabled by **Microsoft** and a "computer lock" to block illegal activity. These scareware prompts are designed to pressure victims into contacting the fake **Microsoft Technical Support** team. Upon calling, the threat actor instructs them to download and install free remote desktop tools like **Ultraviewer**, granting them full control over the infected machine. Browser fingerprinting is crucial in determining the redirection path, either to a tech support scam or another affiliate marketing platform that further evaluates and resells the traffic. These pathways can lead to scam landing pages with fake **CAPTCHA** checks designed to enroll the victim's browser in push-notification spam. "Historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms give us a high degree of confidence that **ROI777** and **Hotejka** are one and the same," **Infoblox** affirmed. ## Hotejka's Bold Criminal Intent Messages posted by **Hotejka** on their **Telegram** channel (@hotejka_hot) openly advertise their criminal activities, promoting forced browser extension installations and tech support landing pages that are "very difficult to exit." In a post dated July 17, 2026 (sic), the operator even boasted about a "small call center in Germany will handle 50-100 calls per day." Since April 2026 (sic), the scams have increasingly utilized free **Cloudflare Pages** sites (*.pages[.]dev), with the threat actor creating approximately 300 disposable pages daily. Over 20,000 such domains have been detected since then. **Hotejka** has also been observed using various aliases on forums like **CrackingX**, seeking traffic from email spam and access to **WordPress** admin panels for prices starting at $100. Approximately 20 different affiliates, including **Balada Injector**, **Detour Dog**, and **DollyWay**, send traffic to **Help TDS**. These operations are notorious for heavily targeting **WordPress** sites to redirect victims to scams and malware. "**Hotejka**/**ROI777** has been loyal to the two affiliate platforms since 2017, and we believe that loyalty has paid handsomely," **Infoblox** concluded. "Using DNS volumes observed over the past 8 years, our ability to use affiliate IDs to track traffic over time, and commonly cited payout figures for affiliate advertising in general, we suspect that the two European programs have paid them at least a few million dollars (USD)."