Web threats / Tech-support scams
HelpTDS tech-support scam kit
HelpTDS is a redirect chain that takes visitors from compromised websites to a fake Microsoft Windows security alert claiming an Emotet infection. Each hop runs on a randomly named Cloudflare Pages host. We have matched it on 183 sites since 6 September.
HelpTDS in numbers
Since 6 September, the first HelpTDS match in our records, counted on 1 November 2026. How we count.
| Sites with HelpTDS code | 183 |
|---|---|
| Sites with a match in the last 30 days | 151 |
| New sites in October | 132 |
Three ways into the /help/ stage
Every infected site sends its visitors to /help/? followed by an 11 to 14 digit campaign number on an 18-character *.pages[.]dev host, such as ahqz1z92seviy8vi35.pages[.]dev or zjo1hiw9rdnk2u8vrp.pages[.]dev. The host and the campaign number change from site to site. The redirect gets onto the site in one of three ways:
- The whole page is replaced by a zero-delay meta refresh to the stage, with an
extra_param_1value of 20 time-ordered characters. We saw this form from 6 September to 18 October 2026. - A script that calls
window.location.replace(...)and then setslocation.hrefto the same address is written in front of the theme's doctype. - The WordPress home and site URL settings are changed to the stage address. The site's own scripts, styles and pingback links then load from beneath it, as
/help/?<id>/wp-content/..., and every visit leaves the site.
Other links into the stage add extra_param_3 and sub_id_1 values.
The stage hands out an encrypted ticket
The /help/ page says "The Document has moved" and runs one line of script that sends the browser to /win/index.php?vq= on the same host. The vq value is an encrypted token made for that visit.
A fake Emotet warning asks for a phone call
/win/index.php serves a page titled "Windows Microsoft" with a "Microsoft Windows Security - Spyware Alert". It says the computer is infected with Trojan:Emotet.35 and tells the visitor to call Microsoft Windows Support.
A later build draws the warning on a canvas, with lines such as "A dangerous ransomware that will lock your device!" and "A technician will help you solve the problem." The contact text sits in the page as decimal HTML entities shifted by a fixed offset, so a search of the source for a phone number finds nothing.
What we see
| Month | New sites |
|---|---|
| September | 34 |
| October | 132 |
| November so far | 17 |
Checking a site
Load the site logged out and watch where the first request goes. Then check:
- the WordPress
homeandsiteurloptions, in Settings and in thewp_optionstable - the top of each theme template, above the doctype, for a
window.location.replacecall - page HTML and cached copies for a meta refresh to a
pages[.]devhost with/help/?and a long number
Restore the home and siteurl values, remove the injected redirect and purge page, plugin and CDN caches. Find the access used to make the change and rotate the WordPress, hosting and database credentials.