Critical Cloudflare Vulnerability Abused to Push Fake Microsoft Security Alerts

Key Takeaways

• Over 20,000 Cloudflare Pages domains have been exploited by threat actors for six months to host fake Microsoft security alerts.
• The campaign, orchestrated by the Russian-language affiliate program Hotejka, directs users to tech support scam call centers.
• Victims are pressured into installing legitimate remote access software, providing attackers with potential system control for data theft or further compromise.
• The threat actors leverage disposable Cloudflare Pages infrastructure, announcing hundreds of new domains daily via Telegram to evade detection.
• Infoblox has identified the operation and offers detection models that can predict related domains approximately seven days before they become active.

Hackers Leverage Cloudflare Pages for Widespread Tech Support Scams

In an extensive campaign spanning six months, threat actors have illicitly utilized over 20,000 Cloudflare Pages domains. Their objective: to disseminate fabricated Microsoft security alerts and funnel unsuspecting users into fraudulent call centers. This sophisticated operation, detailed by Infoblox researchers identified, relies on the Help Traffic Distribution System (Help TDS) to redirect traffic from compromised websites, malicious advertisements, social media platforms, and spam campaigns toward these tech support scams.

Upon landing on these deceptive pages, users are confronted with alarming messages falsely claiming that Microsoft has disabled their computer. Loud alarms often blare, and a prominent support number is displayed. A browser lock mechanism further enhances the illusion that the device is unusable, coercing victims into contacting individuals posing as Microsoft technicians. The ultimate goal extends beyond simple payment for bogus repairs; attackers aim to gain remote access to the victim’s system.

The Infoblox researchers identified this malware-linked operation and have attributed Help TDS to Hotejka, a Russian-language affiliate program. Their research report, published on October 15, establishes a connection between Hotejka and ROI777 through historical DNS records, shared infrastructure, affiliate identifiers, and access to its affiliate panel. The origins of this operation trace back to at least April 2017.

Exploiting Cloudflare Pages and Deceptive Tactics

The Help TDS system employs a reconnaissance phase, examining browser details and geographical location before directing each visitor to a specific landing page. Users deemed suitable for the scam are first shown a fake update notification, followed by Microsoft-branded warning messages. Previous investigations into Help TDS website redirects have highlighted how malicious PHP templates and WordPress plugins transform legitimate websites into conduits for similar scam operations.

In June 2026, Infoblox conducted a test of the call center. An operator, claiming to be from Microsoft Technical Support, inquired about the computer’s ownership (personal or business) and assisted in removing the browser lock. Subsequently, the operator instructed the researchers to download UltraViewer, a legitimate remote desktop tool that can be maliciously repurposed for unauthorized system access.

The interaction concluded when researchers questioned the necessity of additional software. This detail is crucial: UltraViewer is not presented as a custom malware payload. Instead, the scam’s effectiveness hinges on convincing users to voluntarily install remote access software, thereby creating an avenue that could facilitate data exfiltration or subsequent cyberattacks.

Disposable Infrastructure and Evasion Techniques

Since April 2026, the group behind Help TDS has hosted its traffic distribution system and scam pages on ephemeral Cloudflare Pages sites. They frequently announce approximately 300 new domains daily via Telegram channels, a tactic that helps them evade detection. Prior analyses of Cloudflare developer domain abuse have shown that criminals also exploit these services for phishing redirects and fraudulent verification pages.

Beyond the 20,000 domains directly linked to the core Help TDS operation, Infoblox detected an additional 10,000 Cloudflare Pages domains seemingly involved in phishing or decoy activities. Some of these pages display seemingly innocuous advertisements during direct scans, masking their true malicious intent. It is important to clarify that these figures represent attacker-created infrastructure, not compromised Cloudflare customer accounts.

The affiliate code dynamically retrieves current routing domains from Telegram, utilizes a fallback server, and refreshes cached results every 30 seconds. This setup allows the operators to limit scam displays to specific call center operating hours. GoDaddy has previously documented the malicious WordPress plugin infrastructure that underpins these redirects.

Infoblox has identified roughly 20 affiliates involved in this ecosystem, including prominent names like Balada Injector, Detour Dog, and DollyWay. Earlier research into DollyWay WordPress malware infections has illuminated how compromised websites contribute traffic to these scam networks, connecting infected sites to the individuals who ultimately encounter these deceptive alerts.

Infoblox reports that its detection models can identify related domains approximately seven days before they are actively deployed. Consequently, exposure among its cloud customers decreased from daily peaks of 4% to less than 0.5% in September. These figures represent vendor-specific exposure and should not be interpreted as confirmed infection rates or a measure of the entire campaign’s reach.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Educate Users: Regularly remind employees and users that legitimate tech support will never initiate contact via alarming pop-ups, browser locks, or unsolicited calls.
• Verify Support: If a security alert appears, always independently verify the information by visiting the official vendor’s website (e.g., Microsoft’s support page) or contacting their official support channels directly. Do not use phone numbers or links provided in suspicious alerts.
• Do Not Install Unsolicited Software: Never download or install remote access software (e.g., UltraViewer, TeamViewer) or any other application at the request of an unverified “tech support” representative.
• Use Ad Blockers and Security Software: Deploy robust ad blockers and endpoint security solutions with real-time threat detection to help prevent redirection to malicious sites and detect potentially unwanted programs.
• Report Suspicious Activity: Report any suspicious pop-ups, calls, or websites to your IT department or relevant authorities.
• Keep Software Updated: Ensure operating systems, web browsers, and all security software are kept up-to-date to patch known vulnerabilities that attackers might exploit.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.