A deep dive into Help TDS, a long-running traffic distribution system active since 2017 and linked to the Hotejka affiliate program.
The operation uses PHP templates on compromised websites to redirect visitors to tech support scams leveraging full-screen browser manipulation.
This activity is based on a system that redirects visitors from compromised websites to fraudulent pages. Security researchers have found strong evidence that the current network, known as Hotejka, is a continuation of an older organization called ROI777, which was exposed by experts in 2018.
According to data uncovered by cybersecurity firms, the scheme has been offering ready-made code to partners for years, who install it on unsuspecting websites that have been compromised. When users visit these pages, the system checks their device and location and automatically directs them to fake warnings that appear to come from Windows.
These warnings claim that the computer is experiencing a problem and ask victims to call a technical support phone number. If the user calls, the attackers convince them to install a remote control program on their device, giving them access.
READ ALSO
New spyware automatically infects devices just by showing ads
Since April 2026, the fraudsters have been using free web hosting services to set up hundreds of temporary pages every day. In total, more than 20.000 such addresses have been identified related to the same activity.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)