RESEARCHERS examining a long-running Microsoft-themed tech support scam have exposed how a traffic distribution system (TDS) run by a Russian-language advertising network is used to funnel victims to fake Microsoft support operations. The operation, dubbed Help TDS, directs Web traffic through more than a dozen affiliates and uses malvertising, compromised sites, and other channels to fingerprint and redirect users to either the scam or other monetisable destinations.
Investigators from Infoblox gained direct access to the affiliate panel, revealing links to the Microsoft-themed scam and to a malicious WordPress plug‑in previously documented by GoDaddy. Hotejka, the operator behind Help TDS, leverages its panel to choose the tech support campaign and orchestrate broader monetisation schemes.
In practice, when a victim is routed to the scam, Windows shows a security alert demanding a restart and then a fake Windows Security Centre warning that access is blocked. The attackers push a remote-desktop tool, such as Ultraviewer, and guide the user through steps to facilitate ongoing access. The operation relies on a rapidly changing command-and-control (C2) setup, including a Telegram channel with C2 rollovers every five minutes, making it harder to track.
A notable infrastructure abuse involves Cloudflare Pages, with Infoblox reporting hundreds of new domains daily and tens of thousands of pages created in six months, often via domain-generation algorithms. Keitaro remains the orchestration server; investigators question whether it is licensed or cracked. Cloudflare has been notified of some domains, with the researchers continuing to document the abuse. 19 October 2026