Inside the Microsoft Tech Support Scam Powered by Help TDS
Researchers from Infoblox have revealed details about a significant tech support scam operation that impersonates Microsoft, utilizing a malicious traffic distribution system (TDS) known as Help TDS. This operation has been active since 2017, leveraging legitimate tools and infrastructure to deceive users.
The Help TDS system redirects web traffic to various destinations, originally designed for digital advertising partners to manage traffic. However, over the years, it has been exploited by numerous cybercriminals who have created their own underground versions marketed on the Dark Web. These tools are commonly used in malvertising campaigns and ransomware attacks, redirecting unsuspecting users to malicious sites while avoiding detection by security measures.
Victims of Help TDS are often met with fake security alerts designed to scare them into calling a support number. The call center is operated by cybercriminals posing as Microsoft employees, aiming to convince victims to install remote desktop tools on their devices. Infoblox researchers noted, “It’s not simple credit card fraud: it’s remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again.”
During their investigation, Infoblox gained access to Help TDS’s affiliate panel, revealing that it serves as the routing infrastructure for various scam operations rather than legitimate advertising partners. Some affiliates linked to Help TDS include notorious malware operations like Balada Injector and DollyWay.
Infoblox identified that Help TDS is operated by Hotejka, a Russian-language advertising affiliate network. While the researchers did not disclose how they accessed the affiliate panel to protect their access, they provided additional evidence to Dark Reading, including screenshots of the Hotejka panel, which displayed familiar features of advertising networks.
The affiliate panel also contained direct links to tech support scam campaigns and a malicious WordPress plugin previously documented by GoDaddy researchers. Affiliates can easily select the tech support scam as a campaign to run, allowing for widespread distribution.
When a threat actor selects the tech support scam, users are redirected through Help TDS, where they are fingerprinted and routed to the scam or another affiliate platform. The scam begins with a Windows notification prompting a required update, followed by a fake warning from Microsoft Windows Security Center instructing users to call a listed number for support.
Infoblox’s investigation included a call to one of the numbers listed in the scam alert. Renée Burton, vice president of threat intel at Infoblox, spoke with an individual claiming to be a Microsoft support employee. The conversation revealed that the threat actor assured Burton she would not be charged for support and directed her to download a remote desktop application.
Burton noted that the Help TDS operation has three distinguishing features compared to other tech support scams. First, the browser lock component effectively disables keyboard access, enhancing the social engineering aspect. Second, the operation uses a Telegram channel for command-and-control rollovers, changing domain sets frequently to evade detection. Lastly, the unique affiliate model allows for significant scalability, connecting with major names in the malware industry.
Help TDS also abuses Cloudflare’s infrastructure, creating numerous disposable Cloudflare Pages sites. Infoblox reported detecting over 20,000 such domains within a six-month period, with the threat actors generating approximately 300 new Cloudflare Pages sites daily. This rapid creation of domains complicates tracking and documenting the abuse.
Despite Infoblox’s efforts to reverse-engineer the algorithms used by Hotejka, challenges remain in monitoring the operation due to the fast-paced nature of the command-and-control changes. The Help TDS operation continues to run on the same Keitaro server it was initially deployed on, raising concerns about the security and misuse prevention of the platform.
Infoblox has reported some of the recent domains to Cloudflare, which is currently reviewing the information provided.
Source: Dark Reading