// CloudflareMEDIUM
Threat actors have abused over 20,000 Cloudflare Pages domains since April 2026 to host a tech support scam campaign. The operation, linked to the Hotejka affiliate program, displays fake Microsoft security alerts and directs victims to call scam centers, with the goal of obtaining remote access via legitimate remote desktop tools. Infoblox research attributes the infrastructure to multiple affiliates and estimates the campaign dates back to at least 2017, with approximately 300 new domains announced daily via Telegram.
// Get alerts for Cloudflare