Tech Support Scam Network Linked to Russian-Language Affiliate Program Hotejka

A traffic distribution system known as Help TDS has been linked to Hotejka, a Russian-language affiliate program that appears to be a rebrand of an operation called ROI777. Help TDS is assessed to have been active since at least 2017. It supplies PHP code templates to affiliates, who install them on compromised websites to send unsuspecting visitors to tech support scams.

These scams use full-screen browser tricks and exit prevention to show fake Microsoft Windows security alerts, telling victims to call a support number. Infoblox says the goal goes beyond simple card fraud: call centre staff use social engineering to convince people to install remote desktop tools, and once in, the threat actor can exploit the victim repeatedly. GoDaddy documented the network's evolution in August 2025, including a malicious WordPress plugin called "woocommerce_inputs" used on thousands of sites to steal WordPress user credentials and fetch redirect addresses from command-and-control servers. Affiliates inject the plugin, or a custom HTML block, into sites. Redirect tracking has also shown traffic being handed to VexTrio Viper, a cybercrime operator running an affiliate program for scams, riskware, spyware, adware and pornographic content.

The suspected predecessor, ROI777, was exposed by Guardicore Labs in June 2018 in connection with Operation Prowli. That campaign compromised vulnerable servers, deployed malware named r2r2 to mine cryptocurrency, and exploited WordPress and other content management systems for traffic monetisation fraud.