Essential Insights
- Hotejka’s Help TDS funnels users from compromised sites, ads, social media and spam to fake support services.
- Scammers use social engineering to persuade victims to install remote-access tools such as UltraViewer, enabling device control and further exploitation.
- The operation generated 20,000+ associated domains and 10,000 decoy or phishing pages in six months.
Threat, Techniques, and Targets
The Russian-language operation Hotejka has directed internet users to fake tech-support call centers since at least April 2017. Infoblox assesses that Hotejka likely rebranded from ROI777.
The operation uses Help TDS to route potential victims from compromised websites, malicious ads, social media, and spam to scammers. Since April 2026, Hotejka has used Cloudflare Pages to create hundreds of pages each day. Over six months, Infoblox detected more than 20,000 related domains and about 10,000 pages that appeared to support phishing or act as decoys.
Scammers may persuade victims to install remote desktop software, such as UltraViewer, and grant access to their computers. As a result, the scammers could take control of those devices.
Impact, Security Implications, and Remediation
Remote access could let scammers exploit a victim’s device beyond the initial call. Therefore, these scams pose a greater risk than nuisance sales or payment theft. Infoblox reported that exposure among its cloud customers fell from a peak of up to 4% on one day to less than 0.5% by September 2026.
The source does not provide specific remediation steps. Obtain current guidance from the relevant software vendor or cybersecurity authority.
Stay Ahead with the Latest Tech Trends
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
