ZeroHour
Story · 2 sources · 2 articlesfirst updated ()

AI-generated fake Avast renewal page targets Belgian users in callback scam

lowPhishing & fraudimportance 42
What's new: First merged summary for this story. New development: scammers are now using AI to build polished, localized fake antivirus renewal pages — evidenced by AI-style code comments and an unconnected form — removing the traditional skill barrier and enabling rapid production of convincing phishing pages that feed phone-based remote access scams.
Merged summary · glm-5.3-flash · rewritten as coverage arrives

Malwarebytes uncovered a fake Avast Premium Security renewal page aimed at Belgian users that was likely generated with AI: polite French code comments resembling an assistant's unfinished handover, plus an order form never wired to send data anywhere,…

Malwarebytes analyzed a fake Avast renewal page (reported by Malwarebytes Labs on 2026-09-16 and covered by Help Net Security on 2026-09-17) impersonating Avast Premium Security for Belgian users in French. The page claimed a €129.99 subscription renewal and used a cancellation form to collect only the victim's name, email address, and Belgian mobile number — and according to Malwarebytes, the form was never actually connected to send data anywhere. Stylistic clues, including leftover French code comments written politely and reading like an AI assistant's unfinished contractor handover notes, plus generic styling and feature-free marketing copy, indicate the page was generated with AI assistance. The harvested details feed follow-up phone calls (vishing) in which fake support agents pressure victims into installing remote access software. Both reports conclude that AI substantially lowers the skill barrier, enabling scammers to produce polished, localized scam pages rapidly — 'in minutes' per Help Net Security — across brands and languages at scale.

  • Fake page impersonated Avast Premium Security, claiming a €129.99 subscription renewal (Malwarebytes, 2026-09-16).
  • The page targeted Belgian users and was written in French.
  • A cancellation form requested only the victim's name, email address, and Belgian mobile number.
  • Malwarebytes found the form was never connected to send data anywhere.
  • Leftover French code comments, written politely and resembling an AI assistant's unfinished contractor handover, suggest the page was AI-generated; generic styling and feature-free marketing copy supported this conclusion.
  • Harvested phone numbers enable callback (vishing) calls in which fake support agents pressure victims to install remote access software.
  • AI generation lowers the skill barrier, allowing convincing, localized phishing pages to be produced in minutes and scaled across brands and languages.
  • The finding was reported by Malwarebytes Labs (2026-09-16) and covered by Help Net Security (2026-09-17); the two accounts are consistent with no disagreements.

Coverage timeline

  1. · 1d ago
    Malwarebytes Labs· 35
    AI helps scammers build convincing antivirus renewal pages

    Malwarebytes found scammers using AI to build polished fake antivirus renewal pages impersonating Avast, harvesting names, emails and phone numbers for follow-up fraud calls.

  2. · 1h ago
    Help Net Security· 42
    Scammers leave AI fingerprints all over fake antivirus renewal page

    Malwarebytes found an AI-built fake Avast renewal page in Belgium whose contractor-style code comments show scammers now generate polished pages with AI.