Hackers Exploit 20,000 Cloudflare Pages Domains to Deliver Fake Microsoft Security Alerts

Over a six‑month period, attackers hijacked more than 20,000 Cloudflare Pages domains to deliver fake Microsoft security alerts and funnel visitors to tech‑support scam call centers.

The campaign relies on a traffic distribution service known as Help Traffic Distribution System (Help TDS). Help TDS routes visitors from compromised websites, malicious advertisements, social media posts, and spam into staged tech‑support pages and operator call centers.

When targeted users are selected, they are shown a Microsoft‑branded alert claiming the computer has been disabled, accompanied by loud alarm sounds and an on‑screen phone number. A script that locks or severely interferes with the browser makes the device appear unusable and pressures victims to call someone posing as a Microsoft technician. The primary objective is to obtain remote access to victims’ systems rather than simply collecting payment for fake repairs.

Researchers at Infoblox uncovered the operation and attribute Help TDS to a Russian‑language affiliate program called Hotejka. Their October 15 research report ties Hotejka to an older affiliate network known as ROI777 through historical DNS records, shared infrastructure, affiliate identifiers, and access to an affiliate control panel. Infoblox states the overall operation dates back to at least April 2017.

How the distribution and scam work

Help TDS inspects browser characteristics and geographic information before deciding how to route each visitor. Selected users see a fake update or security notice that escalates into Microsoft‑styled warnings.

Previous reporting about Help TDS redirects has shown how malicious PHP templates and compromised or malicious WordPress plugins can turn legitimate websites into entry points for these scams.

Infoblox conducted a live test of one of the call centers in June 2026. In that interaction, an operator claimed to be Microsoft Technical Support, asked whether the machine belonged to an individual or a business, and offered to remove the browser lock. The operator then instructed the researchers to download UltraViewer, a legitimate remote‑desktop application that attackers can misuse to gain persistent access to a victim’s system.

The call ended after the researchers questioned why additional software was required. That distinction is important: UltraViewer itself is not delivered as a custom malware payload. The scam depends on convincing victims to willingly install legitimate remote‑access software, creating a vector for data theft or further intrusions.

Disposable Cloudflare Pages infrastructure

Beginning in April 2026, the group began hosting its TDS and scam landing pages on throwaway Cloudflare Pages sites. The operators post roughly 300 new domains per day to a Telegram channel. Previous reporting has also documented how criminals abuse Cloudflare developer domains for phishing and fake verification pages.

In addition to the 20,000 domains linked to the core Help TDS routing, Infoblox found another roughly 10,000 Pages domains likely used for phishing or as decoys. Some of those pages display innocuous advertisements when scanned directly, helping conceal their malicious role. Infoblox emphasizes these counts represent attacker‑created infrastructure rather than 20,000 compromised Cloudflare customer accounts.

The affiliate code used by the operation pulls a current list of routing domains from Telegram, falls back to a secondary server if needed, and refreshes cached results every 30 seconds. The system can also be configured to show scams only during the call center’s working hours. GoDaddy has previously documented a malicious WordPress‑plugin infrastructure that supports similar redirects.

Infoblox identified about 20 active affiliates in the ecosystem, including groups using names like Balada Injector, Detour Dog, and DollyWay. Past research into DollyWay‑related WordPress infections explains how compromised sites feed visitor traffic into these scam networks and links website infections to the users who later encounter fake alerts.

According to Infoblox, its detection models can usually identify related domains around seven days before they are used in the campaign. Among Infoblox cloud customers, exposure to these domains dropped from daily peaks of about 4% to below 0.5% by September. Infoblox notes these are vendor‑specific exposure metrics, not a definitive measure of the entire campaign or global infection rates.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re‑fange only within controlled threat‑intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat‑intelligence feeds with data from thousands of SOCs.