Dark Reading reported on October 19, 2026, that Infoblox researchers had accessed the affiliate panel for Help TDS, a traffic-routing system that directs visitors toward fake Microsoft support calls. In a separate investigation, Infoblox threat-intelligence vice president Renée Burton called a number displayed by a fraudulent alert. The purported agent tried to get her to download UltraViewer, a remote-access tool; Dark Reading reported that the call lasted 13 minutes.
How Help TDS turns traffic into a support scam
Help TDS evaluates visitors, including through browser fingerprinting and location checks, before routing them to a tech-support scam or another affiliate destination, according to Infoblox. The lure can imitate a Windows update or security warning, lock the browser, sound alarms and display a phone number with instructions to call.
Infoblox dates Help TDS and earlier forms of the system to at least April 2017. The company assesses that the affiliate program Hotejka operates it and is a rebrand of the earlier operation ROI777. It identified about 20 affiliates in 2026, including Balada Injector, Detour Dog and DollyWay.
The panel offered Microsoft-themed scam lures alongside other traffic-monetization options, according to Dark Reading. Microsoft is the brand being impersonated in the alerts and calls.
The call pushed toward remote access
Infoblox says Burton encountered the browser lock and called the number in mid-June 2026. The purported Microsoft support agent asked her to download UltraViewer. The call was an investigative interaction, not a reported victim loss.
A request to install remote-access software changes the stakes: the interaction is no longer limited to a frightening screen or a phone conversation. Microsoft says it does not make unsolicited calls to provide technical support, and its genuine error and warning messages do not include phone numbers.
A WordPress plugin also collected site data
GoDaddy Security describes woocommerce_inputs as a malicious plugin used to redirect site visitors into tech-support scams. GoDaddy estimates it was installed on more than 10,000 websites worldwide. Its analysis says version 1.5 sent WordPress usernames, email addresses, display names and site URLs to the Help TDS command-and-control server, the system used to communicate with infected sites. GoDaddy says the plugin is not affiliated with WooCommerce or Automattic.
GoDaddy observed the plugin evolving from late 2024 through June 2025. It reports that version 2.0.0 added automatic daily update checks. The findings concern this malicious plugin, not the official WooCommerce software.
Infoblox reported changing exposure and domain counts
Infoblox says Hotejka began using disposable Cloudflare Pages sites for its traffic-distribution infrastructure in April 2026 and created roughly 300 pages a day. Through mid-September, Infoblox had detected more than 16,000 domains that Hotejka later used for Help TDS. It separately reported about 30,000 associated domains detected overall.
The company's detection figures describe its own cloud customers. Infoblox reported the following exposure measurements for different periods:
| Observation period | Exposure among Infoblox cloud customers | Context |
| A single day after the move to Cloudflare Pages | Up to 4% | Highest reported daily exposure |
| September 2026 | Below 0.5% | After new detection methods were deployed |
Infoblox says it implemented a domain-prediction algorithm in July 2026. Its detections averaged about seven days ahead of the actor's announcements. The September exposure figure followed the deployment of new detection methods.
Reach Microsoft support through a user-initiated channel
A phone number in a Microsoft-branded warning is a clear reason to stop and avoid calling it: Microsoft says genuine error and warning messages never contain support numbers. It also says it does not make unsolicited technical-support calls. To get help, users can start through Microsoft Support on the web or through Get Help in Windows.
