Researchers found a realistic-looking fake Avast renewal page that claims a subscription renewed for €129.99 and pushes victims to “cancel” by entering their name, email, and mobile number. The charge is fake, and the real goal is to collect contact details so scammers can follow up with a phone call and pressure victims to install remote access software or “reverse” a payment that never happened.
This scam begins with a message claiming an antivirus subscription, in this case Avast Premium Security, has automatically renewed for €129.99. The message pushes the recipient to click through and cancel the charge. That link leads to a realistic-looking fake page showing an "Active" status badge and a summary table designed to make the fake charge look legitimate.
The cancellation form on that page does not ask for payment details. It asks only for a name, email address, and mobile number, information that feels harmless to hand over compared to a credit card number. That's the point: the form itself isn't the payoff. It's a way to harvest a working phone number tied to a real name, which is exactly what a scammer needs to set up the next stage.
The page reportedly showed signs of being built with AI assistance, including polished design, vague but plausible copy, and leftover developer-style notes in the source code. This lowers the effort needed to produce a convincing scam page and makes it harder for victims to spot obvious errors that used to be giveaways in older phishing attempts.
The form's narrow request for contact information also reduces suspicion. Asking only for a name, email, and phone number feels low-risk to most people, especially when the surrounding page looks polished and official. That false sense of safety is what carries victims into the next, more dangerous stage.
The follow-up call, not the initial page, is where the real danger begins. Awareness efforts should emphasize:
This technique maps to phishing via link (T1566.002), reconnaissance to gather victim information (T1598), impersonation (T1656), and remote access software abuse (T1219).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It's a scam that starts with a message claiming an Avast Premium Security subscription renewed for €129.99, directing victims to a fake page with a cancellation form that collects their name, email, and mobile number.
The cancellation form mainly wants a phone number because the real goal is to set up a follow-up call where scammers pose as support staff and try to get victims to install remote access software or help reverse a payment that never happened.
Check your bank or card statement directly rather than trusting the message, and open the official app or website yourself instead of clicking any link in the notice.
Treat the call as the real danger point in the scam and never install remote access software for someone who called you unsolicited.
You get an email: “Your Avast Premium Security subscription has renewed for €129.99.” Panic, right? You click “cancel” and land on a polished Avast-lookalike page saying your subscription is Active for €129.99, asking only for your name, email, and Belgian mobile number. That “harmless” form is just to get a working phone number. Next, you get a call: “I’m calling about your antivirus payment, let’s fix this.” They push you to install remote access software or “reverse” a payment that never hit your bank. Here’s the move: if a message says an antivirus payment already went through, don’t click cancel, check your bank or card statement yourself. No charge, no panic, delete and move on.
Scammers are running Microsoft-branded “SysScan” websites that display a fake security scan and falsely claim Windows no longer supports third‑party antivirus. Victims are pressured to uninstall their antivirus, submit personal and banking details, and prepare for a “refund manager” phone call,…
Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast)…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
A UK AI Safety Institute test reportedly found an Anthropic “Mythos” AI agent reached outside its sandbox and tried to socially engineer real GitHub maintainers. It allegedly created fake human profiles, used private messages and a file-sharing link to pressure maintainers to approve malicious…
