Scammers leave AI fingerprints all over fake antivirus renewal page

AI appears to be helping scammers with little web development skill build convincing fake antivirus-renewal pages, Malwarebytes found.

The researchers came across a scam page impersonating Avast, aimed at users in Belgium, that was more polished than most sites of its kind. The page told visitors their Avast Premium Security subscription had renewed for €129.99, covered five devices, and would renew again in February. A green checkmark sat beside a badge reading “Active,” and a summary table laid out the amount, payment method, and dates.

Fake Avast Premium Security renewal page (Source: Malwarebytes)

“None of it is real,” Stefan Dasic, Senior Malware Research Engineer at Malwarebytes, noted. “There is no subscription and no charge, and the page has no connection to Avast, whose branding is being used without permission.”

How the scam works

Antivirus renewal scams usually start with a message claiming a subscription has already renewed. Anyone who follows the instructions to cancel it lands on a page built to collect contact details instead.

Below the fake renewal summary was a cancellation form asking for a name, email address, and Belgian mobile number.

“A form asking only for a name, email address, and phone number can feel harmless and is far easier to fill in than a login page,” Dasic wrote. A working phone number attached to a genuine name is what a scammer needs for the next stage, a phone call from someone posing as support staff who tries to persuade the victim to install remote access software or help “reverse” a payment that was never made.

Malwarebytes has previously reported that replying to a scam text raises the value of a phone number on criminal markets, since it confirms the line is active and the person behind it is willing to engage.

Signs the page was AI-built

Two notes were left behind in the page’s code, written in French and addressed to whoever had commissioned the work, explaining that the form did not send data anywhere and that a submission process would need to be connected later.

“They read like a contractor handing over an unfinished job rather than a scammer leaving themselves a reminder,” Dasic said, adding that the courteous, second person summary of what still needed doing “is very much how an AI assistant signs off.”

The code also contained leftover styling from a section that had been deleted, suggesting the page went through several rounds of changes without a final review, and the copy describing the subscription’s benefits ran four paragraphs without naming a single specific feature, such as a firewall or VPN.

“Taken together, these signs suggest that the page was built with the help of AI. Generated code carries no watermark, so that cannot be proven from the files alone.”

An unfinished template

The comments in the code explain that the form sent nothing at all. Two pieces of text would have shown up as visible gibberish had anyone opened the page in a browser to check it, suggesting nobody had.

Dasic concluded the page was most likely half built, or possibly a template meant to be sold on to someone who would connect it to a destination for the stolen details.

Building a page this convincing used to take some design and coding ability, which limited how often such pages could be produced. Whoever built this one could ask for a version in Dutch or German, or one aimed at a different brand, and have it within minutes.

“The old advice was to look for mistakes, bad grammar, the wrong currency, a clumsy layout, or a stretched logo,” Dasic added. “That advice is less useful now because AI can produce fluent copy and polished layouts, while scammers can easily copy real logos.” A page that looks professional is no longer evidence that it is genuine.