Oh... turns out we never posted our research released last week. That work unmasked the affiliate program behind Help TDS and how it works.
Perhaps more interesting was how one of our data scientists was able to detect the C2 domains an average of a week in advance. These ran on Cloudflare Pages and the actor used about a dozen domain generation algorithms... a combination that creates a formidable problem.
#malware #phishing #scam #techsupportScam #wordpress #malware #dga
Infoblox BlogInside Help TDS: Hotejka and Cloudflare AbuseInfoblox attributes Help TDS to Hotejka and detects 16,000 malicious Cloudflare Pages before they are used to direct users to tech support scam call centers.