Malwarebytes found a convincing fake “Avast Premium Security” renewal page targeting users in Belgium, claiming a €129.99 renewal and pushing visitors toward a cancellation flow. The real goal is to harvest a victim’s name, email, and mobile number so scammers can call next while posing as support and pressure the victim into installing remote access tools or “reversing” a payment that never happened.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You open a page that screams: "Your Avast Premium Security subscription has renewed for €129.99." Panic, right? This fake Avast page targets Belgium and pushes a "cancellation" form: name, email, Belgian mobile. It looks legit, but there is no subscription, no charge, and no link to Avast at all. The "aha" here: that harmless phone number is the whole scam. They use it to call you as fake Avast support, pressure you about this imaginary €129.99, and talk you into installing remote access tools or "reversing" a payment that never happened. If you see an unexpected antivirus renewal like this, do one thing: ignore the page, and check your real subscription or bank directly, never through the cancellation form or a follow-up call.
Researchers found a realistic-looking fake Avast renewal page that claims a subscription renewed for €129.99 and pushes victims to “cancel” by entering their name, email, and mobile number. The charge is fake, and the real goal is to collect contact details so scammers can follow up with a phone…
Scammers are running Microsoft-branded “SysScan” websites that display a fake security scan and falsely claim Windows no longer supports third‑party antivirus. Victims are pressured to uninstall their antivirus, submit personal and banking details, and prepare for a “refund manager” phone call,…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast)…
This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing…
