Help TDS / Hotejka Tech Support Scam Campaign: Detecting Compromised Sites and 20,000+ Cloudflare Pages Lures

---
title: Web Server Process Spawning Shell After Possible TDS Template Upload
id: 6d2f7a1b-4c59-4b0e-9c4a-1d8f0a2b7c31
status: experimental
description: Detects IIS/Apache/Nginx/PHP worker processes spawning command shells or scripting engines, consistent with post-compromise deployment of Help TDS PHP redirect templates.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare CMS deployment pipelines or application warmup scripts
  - Legitimate PHP CLI invoked by application pools under a documented admin context
level: high
---
title: Executable Web Content Created In Web Root By Server Or Upload Context
id: 9b4c1a06-7d21-4e3d-a7f9-2c0d5e8b6a44
status: experimental
description: Detects creation or modification of PHP/ASP/ASPX files in common web content directories, a frequent indicator when Help TDS partner templates are injected into compromised sites.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.persistence
  - attack.command_and_control
  - attack.t1505.003
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\wwwroot\'
      - '\htdocs\'
      - '\wordpress\'
      - '\wp-content\'
      - '\uploads\'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.asp'
      - '.aspx'
      - '.ashx'
  filter_known:
    Image|endswith:
      - '\devenv.exe'
      - '\msbuild.exe'
      - '\robocopy.exe'
      - '\xcopy.exe'
  condition: selection_paths and selection_ext and not filter_known
falsepositives:
  - Scheduled CMS/plugin updates
  - Developer deployment activity
  - Backup or migration jobs writing content
level: medium
---
title: Rare Cloudflare Pages Egress With Tech Support Scam Lure Terms
id: 2e7a9c41-8b10-4d65-9b31-7f4a1c9e5d20
status: experimental
description: Detects endpoint DNS or network connections to Cloudflare Pages hostnames containing common scam-lure terms. Intended as a hunting signal correlated with rarity, process context, and user reports.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1204/001/
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.command_and_control
  - attack.execution
  - attack.t1071.001
  - attack.t1204.001
logsource:
  category: dns
  product: windows
detection:
  selection_domain:
    query|contains: '.pages.dev'
  selection_lure:
    query|contains:
      - 'support'
      - 'microsoft'
      - 'windows-security'
      - 'virus'
      - 'alert'
      - 'error'
      - 'warning'
      - 'scan'
      - 'billing'
      - 'renewal'
      - 'applecare'
      - 'geek'
      - 'helpdesk'
  condition: selection_domain and selection_lure
falsepositives:
  - Legitimate Cloudflare Pages projects using support/help naming
  - Security testing and threat-intel validation
level: low

// Microsoft Sentinel / Defender hunt: rare Cloudflare Pages egress with scam-lure context
// Run over 14d to smooth CDN churn and reduce one-off developer noise.
let lookback = 14d;
let lureTerms = dynamic(['support','microsoft','windows-security','virus','alert','error','warning','scan','billing','renewal','applecare','geek','helpdesk','popup']);
let defender = DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemoteUrl has '.pages.dev' or RemoteIPType =~ 'Public'
| extend Host = tostring(parse_url(RemoteUrl).Host)
| where Host endswith '.pages.dev'
| where Host has_any (lureTerms) or RemoteUrl has_any (lureTerms)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Processes=make_set(InitiatingProcessFileName,20), Users=make_set(InitiatingProcessAccountName,20), SampleUrls=make_set(RemoteUrl,5) by DeviceName, Host
| where Hits <= 10; // rarity heuristic; tune to environment
let proxy = CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| extend Url = coalesce(RequestURL, tostring(AdditionalExtensions))
| extend DestHost = coalesce(DestinationHostName, tostring(parse_url(Url).Host))
| where DestHost endswith '.pages.dev'
| where DestHost has_any (lureTerms) or Url has_any (lureTerms)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Srcs=make_set(SourceIP,20), Actions=make_set(DeviceAction,10), SampleUrls=make_set(Url,5) by DestHost, DestinationIP
| where Hits <= 25;
union defender, proxy
| project FirstSeen, LastSeen, Hits, DeviceName, Source=Srcs, Host, DestinationIP, Processes, Users, Actions, SampleUrls
| sort by LastSeen desc;

-- Velociraptor hunt: find recently modified PHP files in web roots and flag TDS/scam markers
-- Deploy to web servers or file servers hosting PHP/CMS content. Review matches before quarantine.
LET roots <= SELECT FullPath FROM glob(globs=['C:/inetpub/wwwroot/**/*.php','C:/inetpub/*/wwwroot/**/*.php','/var/www/**/*.php','/srv/www/**/*.php','/usr/share/nginx/html/**/*.php','/home/*/public_html/**/*.php'])
LET recent <= SELECT FullPath, Mtime, Size FROM stat(filename=roots.FullPath) WHERE Mtime > now() - 1209600
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=200000) AS Content,
       countif(array=[
         Content =~ 'base64_decode',
         Content =~ 'gzinflate|str_rot13|eval\s*\(',
         Content =~ '\$_REQUEST|\$_GET|\$_POST',
         Content =~ 'header\s*\(\s*[\'\"]Location:',
         Content =~ 'window\.location|location\.href',
         Content =~ 'hotejka|roi777|help.?tds',
         Content =~ 'pages\.dev',
         Content =~ 'google|bing|yahoo|duckduckgo'
       ]) AS MarkerHits
FROM recent
WHERE MarkerHits >= 3
ORDER BY Mtime DESC

# Security Arsenal - Help TDS / Cloudflare Pages scam verification & hardening snapshot (Windows/IIS)
# Run elevated on IIS/web servers. Review output before deleting anything; quarantine, do not auto-purge.
$OutDir = Join-Path $env:ProgramData 'SecurityArsenal\HelpTDS-Hunt'
New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
$webRoots = @('C:\inetpub\wwwroot')
Get-IISSite | ForEach-Object { if ($_.PhysicalPath) { $webRoots += $_.PhysicalPath } }
$webRoots = $webRoots | Where-Object { Test-Path $_ } | Select-Object -Unique
$markers = 'base64_decode|gzinflate|str_rot13|eval\s*\(|header\s*\(\s*[\x27\x22]Location:|window\.location|location\.href|hotejka|roi777|help.?tds|pages\.dev|wp-load|admin-ajax|xmlrpc'
$recent = foreach ($root in $webRoots) {
  Get-ChildItem -Path $root -Recurse -Include *.php,*.phtml,*.php5,*.php7,*.asp,*.aspx,*.ashx,*.js -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -or $_.CreationTime -gt (Get-Date).AddDays(-14) }
}
$hits = foreach ($f in $recent) {
  try {
    $txt = Get-Content -Path $f.FullName -Raw -ErrorAction Stop
    $m = [regex]::Matches($txt, $markers, 'IgnoreCase')
    if ($m.Count -ge 3) {
      [pscustomobject]@{ FullName=$f.FullName; Created=$f.CreationTime; Modified=$f.LastWriteTime; Size=$f.Length; MarkerHits=$m.Count; Hash=(Get-FileHash $f.FullName -Algorithm SHA256).Hash }
    }
  } catch {}
}
$hits | Sort-Object Modified -Descending | Export-Csv (Join-Path $OutDir "tds-file-hits-$stamp.csv") -NoTypeInformation
# Capture server-side outbound listener/context and suspicious child processes from web workers over the hunt window.
Get-CimInstance Win32_Process | Where-Object { $_.Name -in @('w3wp.exe','php-cgi.exe','php.exe','httpd.exe','nginx.exe') } |
  Select-Object ProcessId,Name,CommandLine,CreationDate,ParentProcessId | Export-Csv (Join-Path $OutDir "web-workers-$stamp.csv") -NoTypeInformation
# Hardening checks: write/execute separation, FTP exposure, PHP in upload paths, and CMS file integrity.
$findings = @()
foreach ($root in $webRoots) {
  $acl = Get-Acl $root
  $findings += [pscustomobject]@{ Check='WebRootACL'; Path=$root; Detail=($acl.AccessToString -replace "`r?`n",' | ') }
}
Get-WebConfiguration -Filter 'system.webServer/security/requestFiltering/fileExtensions' -ErrorAction SilentlyContinue | Out-String | Set-Content (Join-Path $OutDir "request-filtering-$stamp.txt")
Get-WindowsOptionalFeature -Online -FeatureName IIS-FTPServer,IIS-FTPSvc -ErrorAction SilentlyContinue | Export-Csv (Join-Path $OutDir "ftp-features-$stamp.csv") -NoTypeInformation
Write-Host "Review $OutDir. Next: preserve evidence, compare hashes to clean CMS source, rotate CMS/FTP/DB credentials, patch CMS/plugins, block confirmed scam domains at DNS/proxy, and enable Defender SmartScreen/PUA." -ForegroundColor Yellow