Published on October 17, 2026
Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts
Severity
Medium
Detail
Infoblox researchers have published an analysis detailing a massive technical support scam campaign driven by the Help Traffic Distribution System (Help TDS), which has abused over 20,000 Cloudflare Pages domains over a six-month period. Attributed to the Russian-language affiliate program Hotejka (historically linked to ROI777 and active since at least 2017), the operation leverages compromised websites, malvertising, social media, and spam to route victims to fake Microsoft security alert pages.
Equipped with browser lockers and audio alarms, these pages coerce victims into calling scam call centers where operators trick them into installing legitimate remote desktop software, such as UltraViewer, to gain unauthorized system access.
How?
The attack chain begins when internet users encounter poisoned search results, malicious ads, spam links, or compromised websites (such as sites injected via Balada Injector or DollyWay) that feed traffic into the Help TDS network.
The traffic distribution system evaluates each visitor’s browser details and geographic location before dynamically routing them to active scam pages hosted on disposable Cloudflare Pages domains.
Once a visitor lands on the destination page, the sequence unfolds as follows:
- Browser Locking & Social Engineering: The page displays a fake critical update notice or Microsoft-branded security warning, triggers loud audio alarms, and locks the browser window to simulate an unusable system. The victim is presented with a fake support phone number.
- Call Center Interaction & Tool Misuse: When victims call the number, operators posing as Microsoft Technical Support guide them through removing the browser lock and instruct them to download UltraViewer. Rather than deploying a custom malware payload, the scammers rely on social engineering to trick the user into installing legitimate remote administration software themselves.
- Infrastructure Rotation & Evasion: To maintain resilience against blocklists, the Hotejka affiliate network creates roughly 300 fresh Cloudflare Pages domains daily, announcing them via Telegram. The affiliate scripts refresh cached routing results every 30 seconds, use fallback servers, and can restrict scam displays strictly to call center working hours or show harmless ads during direct security scans to evade automated detection.
Conclusion
The Help Tactical Distribution System demonstrates how cybercrime syndicates abuse legitimate developer hosting platforms like Cloudflare Pages and remote desktop tools to execute scalable technical support scams. Organizations and consumers must remain vigilant against browser-locking tactics and unsolicited tech support instructions.
To mitigate these threats, security teams should block known abusive hosting patterns and monitor network telemetry for unauthorized outbound connections to remote desktop utilities like UltraViewer following suspicious browser activity. Enterprises should enforce robust web filtering to intercept malvertising and compromised redirect sites. End users must be educated never to trust unsolicited pop-up warnings claiming their computer is disabled, never to call phone numbers displayed on unexpected browser locks, and never to grant remote access to individuals claiming to be technical support representatives unless verified through official out-of-band channels.
Source