TDS Hotejka reincarnation of ROI777 leads technical support scams

Security researchers have identified a traffic distrusion infrastructure (TDS) used for years to channel visitors to "technical support" phone scams and other fraud. The findings attribute the operation to a scheme called Hotejka, which is reported to be a reincarnation of the former ROI777. The signatures that published data - including Infoblox and GoDaddy, and historical analysis of Guardicore (now part of Akamai) - describe a chain that starts from committed websites and ends up on fraudulent pages that persuade users to deliver remote control of their equipment or pay for fictional services.

Facts confirmed by the research: the TDS, identified as Help TDS, operates since at least 2017; uses PHP templates and HTML blocks injected into websites (with special predilection by WordPress); and filters and routs visitors using browser fingerprinting techniques and geographical segmentation. GoDaddy documented the use of a malicious WordPress plugin called "Woocommerce _ inputs" that was installed in thousands of sites to steal credentials and serve redirections to domains controlled by the attackers. Final destinations include browser blocking pages that mimic Microsoft alerts and phone numbers for alleged technical assistance; by calling, operators use social engineering to achieve the installation of remote access tools such as UltraViewer.

Technically, the TDS acts as a traffic router: it captures visitors from multiple sources - committed websites, malicious ads, spam or social network links -, evaluates them with rules (IP, country, user agent, automated browser detection) and decides the "best" route: a technical support scam, an adware / spyware installer, a landing for abusive subscriptions or more traffic resale to other affiliated programs. Part of the infrastructure reported is hosted on platforms that facilitate the follow-up of campaigns, such as Keitaro, a legitimate product that has been abused by criminal actors for the performance and rotation of destinations ( keitaro.io).

Researchers have also documented historical continuity: Guardicore traced in 2018 an operation called Operation Prowli linked to ROI777, in which vulnerable servers were engaged for cryptomoneda mining and monetizing traffic. Historical data show that domains associated with ROI777 were used as command and control servers to collect redirection URLs lists between 2018 and 2020, which supports the link between that operation and the current Hotejka. The original Guardicore analysis on Operation Prowli is available for technical and chronological context ( Guardicore - Operation Prowli).

What real risks this entails for users and operators of websites. For a visitor: falling into a technical support scam can result in the installation of remote access software, loss of credentials, theft of financial data and continuous access by the attacker. For a web administrator: an injected plugin or HTML block not only leads to fraud but also facilitates the theft of accounts, the persistence of the attacker on the site, and the damaged reputation of the domain (DNS black lists, legitimate traffic loss, sanctions from accommodation providers).

The operation, according to reports, has also evolved in its tactics to minimize friction: since 2026, disposable pages have been used in services such as Cloudflare Pages to host thousands of redirection domains quickly - more than 20,000 pages detected since April 2026 and an estimated creation of about 300 pages daily - which complicates the simple-listing of domains. (General Information about Cloudflare Pages in developed.)

Distinguishing facts, estimates and doubts. Confirmed: the existence of the TDS, the WordPress injection technique through the "Woocommerce _ inputs" plugin, the use of fingerprinting and the delivery of technical support scams that end up in calls and remote access. Informed estimate: that the two platforms (Hotejka / ROI777) have generated "at least several million dollars" with their affiliates based on DNS volumes and typical payment practices in industry; this comes from data correlation rather than public accounting figures. Still uncertain: the real identity of operators, their exact organizational structure, and to what extent call centres are located or deployed remotely; evidence points to a transnational operation with varied affiliates, but complete traceability still requires additional legal and forensic action.

What concrete measures should readers take

If you manage WordPress sites or any CMS: review the list of installed plugins and remove any unknown or unverified inputs; change user passwords with privileges (and activate multifactor authentication whenever possible); install scanning and locking solutions (e.g. Wordfence, Sucuri) to search for unusual database files or entries; review access records and scheduled tasks (cron) to detect injections; and restart from clean backups if you detect commitments. It blocks PHP file editing from the WordPress panel and limits access to wp-admin by IP when feasible.

If you are an end user and you have a browser lock with phone number- Don't call. Force browser closure (or process from the task manager), delete cache and cookies, and restart the system. If you are asked to install a remote access tool, consider this a clear fraud criterion unless the installation is requested by a verified support to which you have contacted through official channels. If you think you already gave a third party remote access, disconnect the network device, change passwords from a different device and contact your bank if you shared financial data.

For IT companies and suppliers: enable DNS filtering and blocking of malicious domains from the corporate network, monitor unusual requests to mass-created tracking services and static pages, and analyse web-based fingerprinting patterns. Consider implementing anomaly detection and reputation solutions for URLs, and coordinate with hosting providers to remedy compromised sites in your customer base.

The complexity of the ecosystem - TDS, affiliates, disposable pages and abused legitimate tools - makes these campaigns resilient to specific closures. The best defense combines basic hygiene in software, continuous monitoring and user education to prevent a browser closure from becoming permanent access and financial fraud.