Loading story…
A polished French-language phishing page impersonated Avast and told Belgian users that an Avast Premium Security subscription had renewed for €129.99. Its cancellation form requested full names, email addresses, and Belgian mobile numbers, data likely intended to support follow-up vishing campaigns in which fraudsters could pressure victims to install remote-access software or process a fraudulent refund.
The page was nonfunctional when examined: submitted data was not transmitted, and source code contained unfinished form-handling notes, unused code, and implementation defects consistent with possible AI-assisted development, though this could not be confirmed. Users should verify subscription charges only through their bank records and Avast's official application or website, avoid links in unsolicited messages, and never install remote-access tools at an unexpected caller's request.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A fraudulent French-language webpage impersonating Avast claimed a €129.99 Avast Premium Security renewal and solicited victims’ names, email addresses, and Belgian mobile numbers. The examined form did not transmit submissions, and its unfinished code showed indicators consistent with, but not proving, AI-assisted development.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **brand-impersonation phishing** campaigns are targeting consumers by abusing trust in *Avast* and *Apple* to drive victims into disclosing payment or account details. One campaign uses a near-identical fake *Avast* portal aimed at French-speaking users, presenting a fabricated **€499.99** “subscription charge” and a short cancellation window to induce urgency; the site validates entered card numbers using the **Luhn algorithm** and uses a **Tawk.to** live-chat widget (ID `689773de2f0f7c192611b3bf`) to pressure victims in real time into submitting full card details (including CVV) under the pretense of processing a refund. Separate *Apple*-themed scams use **phishing-to-phone** and **SMS** lures to route victims to scam call centers and harvest credentials and financial information. One email purporting to be from an “**Apple Fraud Prevention**” team attempts to panic recipients into calling a fake support number, while an “**Apple Security Alert**” Apple Pay text claims a suspicious **$143.95** Apple Store transaction and urges an immediate call to a `+1 850-85*` number to “cancel” the charge. Another tactic abuses iOS Calendar subscriptions (“**iPhone Calendar Scam**”) to flood devices with fake security/prize alerts that push users to click malicious links; guidance emphasizes unsubscribing from the rogue calendar and avoiding interacting with the spam invites.
Jul 1, 2026
Multiple brand-impersonation scams are targeting consumers by pushing them to interact with **fake customer support** and surrender sensitive data. One campaign uses a fraudulent site styled as **Avast** to convince French-speaking users they were charged **€499.99** and must act quickly to “cancel” and receive a refund; the page dynamically inserts the current date via JavaScript, loads the Avast logo from Avast’s own CDN to appear legitimate, and then harvests full payment-card details (PAN, expiry, and CVV) via a cancellation/refund form. Separate but related social-engineering activity targets **Robinhood** users with “security alert” **SMS** and **email** lures that direct victims to call scam call-center numbers, where operators attempt to extract login credentials, 2FA codes, and other personal/financial information; the email variant also commonly pushes victims toward installing remote-access tools such as *AnyDesk* or *TeamViewer* under the guise of support. In another consumer fraud pattern, scammers posing as a mobile carrier (e.g., **Spectrum**) call shortly after a phone delivery, claim the wrong device was shipped, and trick the recipient into mailing the phone to the attacker—enabling resale and potential identity-fraud follow-on if the device/line is activated under the victim’s details.
Jul 2, 2026
Researchers uncovered a refund scam campaign using Microsoft-branded **"SysScan"** websites that pretend to test whether a victim’s antivirus is working, then display fabricated security findings to claim third-party protection is causing serious problems or is no longer supported by Windows. The pages do not perform real diagnostics; instead, they rely on basic browser-visible system details plus hardcoded or randomized results to ensure alarming outcomes and pressure users to uninstall their antivirus software. After the fake scan, the sites collect extensive personal, banking, antivirus, and remote-access information through forms apparently built to support live scam operators during follow-up calls, including fields for agent identifiers and selected security products. Researchers identified **11** such sites on a single host and found that submitted data is sent directly to **Telegram** via the bot API, after which victims are placed on a waiting page promising a callback from a refund manager; parts of the site code and media also showed signs of being AI-generated or adapted from a broader scam template.
Aug 25, 2026