What Happened
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting
Why It Matters
The report describes Help TDS, a long-running traffic-distribution system linked to the Hotejka affiliate program, using PHP templates on compromised websites to redirect visitors to tech-support scams. The provided summary does not indicate that AI systems, models, or AI agents are involved. RealGround analysis: the incident is therefore only indirectly relevant to AI security; the mapped services could help assess or test AI-enabled systems that interact with compromised web content, but no direct AI-specific risk is established.
RealGround Analysis
This signal maps to AI agent abuse. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html