Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts

Hackers have abused more than 20,000 Cloudflare Pages domains over six months to spread fake Microsoft security alerts and steer users toward scam call centers.

The campaign uses Help Traffic Distribution System, or Help TDS, to route visitors from compromised websites, malicious ads, social media, and spam into tech support scams.

The pages claim that Microsoft has disabled the computer, play loud alarms, and display a support number. A browser lock makes the device appear unusable, pushing victims to call someone posing as a Microsoft technician. The goal is remote access, not simply a payment for fake repairs.

Infoblox researchers identified the malware-linked operation and assessed that Hotejka, a Russian-language affiliate program, runs Help TDS.

Their October 15 research report links Hotejka to ROI777 through historical DNS records, shared infrastructure, affiliate identifiers, and access to its affiliate panel. The operation dates to at least April 2017.

Hackers Abuse 20,000 Cloudflare Pages Domains

Help TDS checks browser details and location before choosing where to send each visitor. Selected users see a fake update notice followed by Microsoft-branded warnings.

Earlier reporting on Help TDS website redirects described how malicious PHP templates and WordPress plugins turn legitimate websites into entry points for similar scams.

Infoblox tested the call center in June 2026. An operator claimed to represent Microsoft Technical Support, asked whether the computer belonged to a person or business, and helped remove the browser lock.

He then instructed the researchers to download UltraViewer, a legitimate remote desktop tool that attackers can misuse for system access.

The call ended after researchers questioned why additional software was needed. This distinction matters: UltraViewer is not presented as a custom malware payload.

The scam relies on convincing users to install remote access software themselves, creating access that could support data theft or further attacks.

Disposable Cloudflare Pages Infrastructure

Since April 2026, the group has hosted its TDS and scam pages on disposable Cloudflare Pages sites. It announces roughly 300 fresh domains daily through Telegram.

Previous coverage of Cloudflare developer domain abuse shows how criminals also use these services for phishing redirects and fake verification pages.

Infoblox detected another 10,000 Pages domains apparently tied to phishing or decoy activity, beyond the 20,000 associated with the core operation.

Some pages show harmless-looking advertisements during direct scans, helping hide their role. These figures describe attacker-created infrastructure, not 20,000 compromised Cloudflare customer accounts.

The affiliate code retrieves current routing domains from Telegram, uses a fallback server, and refreshes cached results every 30 seconds.

It can limit scam displays to call center working hours. GoDaddy previously documented the malicious WordPress plugin infrastructure supporting these redirects.

Infoblox identified about 20 affiliates, including Balada Injector, Detour Dog, and DollyWay. Earlier research into DollyWay WordPress malware infections explains how compromised sites feed traffic into scam networks, linking website infections to the visitors who eventually encounter fake alerts.

Infoblox says its detection models identify related domains about seven days before use. Exposure among its cloud customers fell from daily peaks of 4% to below 0.5% in September. These are vendor-specific exposure figures, not confirmed infection rates or measures of the entire campaign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts appeared first on Cyber Security News.