r2r2

Help TDS, a long-running traffic distribution system active since at least 2017, is linked to the Russian-language affiliate program Hotejka, believed to be a rebranded version of the previously exposed ROI777 operation. The threat actor uses compromised websites, often via a malicious WordPress plugin 'woocommerce_inputs' or custom HTML blocks, to redirect users to tech support scams hosted on disposable Cloudflare Pages domains (*.pages.dev). These scams employ browser fingerprinting and full-screen lock techniques to display fake Microsoft alerts, tricking victims into calling fraudulent support numbers and granting remote access via tools like Ultraviewer. The infrastructure has evolved from cryptocurrency mining campaigns under ROI777 to monetizing traffic through affiliate networks, with historical C2 domains and Telegram activity linking the operations.