For nearly a decade, a shadowy digital infrastructure known as Help Traffic Distribution System (TDS) has served as the backbone for a prolific Russian-language affiliate program currently operating under the name Hotejka. New intelligence from cybersecurity researchers at Infoblox suggests that Hotejka is a strategic rebrand of ROI777, a notorious entity that first surfaced in 2018 during the infamous Operation Prowli. This evolution underscores a persistent, high-revenue cybercrime operation that leverages compromised WordPress sites, sophisticated browser fingerprinting, and social engineering to facilitate global tech support scams and remote-access malware distribution.
The Anatomy of an Enduring Threat
At its core, Help TDS functions as a highly efficient traffic broker. It acts as an automated relay system, intercepting internet traffic from a vast network of compromised websites, malicious advertisements, and search engine optimization (SEO) spam. By analyzing the visitor’s device metadata, geographic location, and IP reputation, the system makes split-second decisions on how to monetize that specific user.
The mechanism is deceptively simple but technically robust. When a user lands on a compromised site, they are often unaware that their traffic is being diverted. Once the TDS evaluates the target, it routes them to one of several malicious outcomes: full-screen browser lockers, fake Windows security alerts, or sophisticated tech support scam landing pages. These pages frequently utilize "exit prevention" techniques—scripts that block users from closing their browser windows—to create a sense of urgency. The goal is to force the victim to call a fraudulent "Microsoft Support" line, where human operators use social engineering to convince the target to install remote desktop software such as UltraViewer, effectively handing control of their computer to the threat actor.
A Chronology of Malicious Evolution
The lineage of this operation can be traced back to 2017, when Help TDS first emerged as a functional platform for affiliate partners. By 2018, the operation was deeply entwined with ROI777, an entity exposed by Guardicore Labs (now part of Akamai) during the investigation into Operation Prowli. At that time, the group was involved in aggressive traffic manipulation and illicit cryptocurrency mining, often compromising servers to deploy the "r2r2" malware.
A critical turning point occurred in March 2018, when a significant data leak from ROI777’s servers exposed internal communications, Telegram handles of key operators, and detailed campaign logs. This breach likely necessitated the group’s transition into the "Hotejka" brand. Historical DNS analysis confirms that the domain "roi777[.]com" remained in use as a command-and-control (C2) node through at least 2020, serving as the bridge between the old infrastructure and the current Hotejka framework.
By August 2025, researchers at GoDaddy documented a significant escalation in tactics, noting the use of a malicious WordPress plugin labeled "woocommerce_inputs." This plugin was deployed across thousands of websites, allowing the attackers to scrape administrative credentials and inject custom HTML blocks that redirected unsuspecting visitors to C2 servers managed by the Hotejka ecosystem.
Scaling the Scam: Cloudflare and Automation
In recent years, the operation has transitioned toward a high-volume, low-cost infrastructure model. Since April 2026, Hotejka has utilized free services like Cloudflare Pages to host its malicious landing pages. The efficiency of this approach is staggering; the group creates an average of 300 disposable domains daily under the *.pages[.]dev top-level domain. Industry observers have noted that more than 20,000 such domains have been identified in just over a year, representing a massive expansion of the threat actor’s surface area.
The shift to these platforms allows the attackers to evade traditional blacklist filters. By constantly rotating domains, they ensure that the "scareware" prompts—which claim a computer has been disabled due to illegal activity—remain active and accessible to victims.
The Affiliate Ecosystem
Hotejka does not operate in a vacuum. It sits at the center of a complex web of roughly 20 distinct affiliate groups, including notorious entities such as Balada Injector, Detour Dog, and DollyWay. These partners are responsible for the "heavy lifting" of compromising websites and driving traffic to the TDS.
The business model is built on loyalty and long-term financial gain. Infoblox’s analysis indicates that the operators of Hotejka have maintained consistent relationships with two major affiliate advertising platforms since 2017. By tracking affiliate IDs and payout metrics across an eight-year period, researchers estimate that the operation has generated at least several million U.S. dollars in illicit revenue. The group actively recruits on underground forums like CrackingX, offering to buy access to WordPress admin panels and email spam campaigns for as little as $100, effectively democratizing the ability to launch sophisticated cyberattacks.
Implications for Global Cybersecurity
The longevity of the Hotejka/ROI777 operation provides a sobering case study in the resilience of cybercrime. By rebranding rather than retiring, the group has successfully navigated the scrutiny of security researchers for nearly a decade.
The implications for victims are severe. Unlike simple credit card fraud, which may result in a quick financial loss, the tech support scams facilitated by Help TDS result in a persistent compromise. By convincing victims to install remote desktop tools, attackers gain a foothold on the victim’s device. This allows for "living-off-the-land" attacks, where threat actors can return periodically to exfiltrate sensitive files, install additional spyware, or use the compromised machine as a node in a larger botnet.
Furthermore, the integration of these operations with legitimate-looking services like Keitaro—a performance tracking platform often abused for malicious redirects—highlights the difficulty in separating legitimate marketing technology from malicious infrastructure. The ability of these actors to pivot between browser-based ads, push-notification spam, and direct social engineering makes them a persistent threat to both enterprise network security and individual privacy.
Defensive Measures and Future Outlook
Security experts emphasize that the primary defense against this threat lies in robust endpoint protection and user awareness. Because the attack chain relies on browser manipulation and social engineering, users should remain vigilant against pop-up alerts that claim a computer is infected or disabled. Legitimate technical support will never solicit remote access through third-party, non-enterprise tools like UltraViewer or TeamViewer.
For website administrators, the threat posed by malicious plugins like "woocommerce_inputs" highlights the critical importance of maintaining strict access controls on Content Management Systems (CMS). Regularly auditing plugins, enforcing multi-factor authentication for administrative panels, and monitoring for unauthorized outbound traffic are essential steps in preventing a site from being weaponized by the Hotejka network.
As Hotejka continues to advertise its services, including the coordination of call centers in Europe, it is clear that the operation is not merely a technical nuisance but a structured criminal enterprise. The transition to decentralized hosting platforms like Cloudflare Pages suggests that the group will continue to favor high-velocity, disposable infrastructure to bypass traditional security filters. The challenge for the cybersecurity community remains to disrupt the financial incentives that keep such long-running operations profitable. Without targeted intervention by infrastructure providers and continued cross-industry intelligence sharing, the Hotejka ecosystem is likely to remain a fixture of the cybercrime landscape for years to come.
