Malwarebytes found AI handover notes left in the code of a fake Avast renewal page
Malwarebytes says the fake Avast renewal page it found aimed at Belgian users was noticeably more polished than most scam sites, with clean French copy, an Active status badge and a form that asks only for a name, an email address and a phone number.
The Watch · Security desk
What happened
- A scam page found by Malwarebytes told Belgian visitors that their Avast Premium Security subscription had renewed for EUR 129.99, covered five devices, and would renew again the following February.
- The lure starts with a message claiming an automatic renewal, and the cancellation instructions route the recipient to the page; the charge it references is invented.
- The only interactive element is a cancellation form collecting a full name, an email address and a Belgian mobile number.
- Two notes in polite French were left in the page code, telling whoever commissioned the work that the form did not yet send anything anywhere and that a submission process still had to be connected.
- Malwarebytes assessed the page as most likely half-built, or a template waiting to be sold on to someone who would add a destination for the stolen details.
Why it matters
- What it limits constraint Awareness advice built on typos and broken layout is useless here: the copy is grammatically correct, and the giveaways Malwarebytes found were in the source code, which a victim does not read.
- Who's exposed exposure The exposed asset is the phone line. A name and a live mobile number put the target in a queue for a support call that asks for remote access software.
- What's now possible capability With the skill floor for building these pages lowered, the limit on this scam becomes who can supply mailing lists and callers to work the submissions.
- What doesn't add up contradiction Malwarebytes rates the page more polished than most, yet says nobody had loaded it in a browser.
Next story · Security · Sep 23
Fake Claude Max giveaway harvests Google logins through a window it draws itselfConfirmed2 publishers
The page asks only for contact details. Malwarebytes said the absent password field and card fields may be deliberate, because a form asking only for a name, an email address and a phone number can feel harmless and is far easier to fill in than a login page [7][8]. "The form is the lure, and the call is where the real danger begins," the company wrote [9].
The call is where a victim loses money. Harvested details can be sold to other scammers or used for the next stage, Malwarebytes said, with someone phoning the victim as support staff and trying to get remote access software installed, or to help reverse a payment that never happened [11]. A working mobile number attached to a real name is the prerequisite for that call [10]. Answering at all makes the record more valuable, because it confirms the number is live and the person engages [12].
The signs of how it was built sit in the source. The two French notes read like a contractor handing over an unfinished job, Malwarebytes said, and that courteous, second-person summary of what still needs doing is how an AI assistant signs off [17]. The file also held styling for a section that had been removed, which the company said suggests the page was produced in stages without a final review [18]. The copy is grammatically correct: four paragraphs on the benefits of the subscription that never mention a specific Avast feature such as the firewall, the VPN or the ransomware protection [19]. Generated code is unmarked, Malwarebytes said, so the files alone cannot establish who wrote the page [20].
Each completed submission would have handed the operator four things: the three form fields, plus the knowledge that this person answers a message about an antivirus payment [13]. None of it reached anyone here: the form sent nothing anywhere [21][24]. Two pieces of text would have displayed as visible gibberish if anyone had opened the page in a browser, according to Malwarebytes [22].
Receiving a message that names your antivirus software does not mean the sender has access to your device or account, Malwarebytes said, because scammers send the same text to large numbers of people knowing some recipients will be customers [15]. The page is unconnected to Avast, whose branding is being used without permission [5].
What to watch
- Whether a finished version of this template appears with a working submission endpoint, and where the data lands.
- Whether the same French-language kit shows up under other antivirus brands or in other markets.
- Whether the callback stage tied to these pages is linked to an identified tech-support fraud operation.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Malwarebytes saw a renewal scam site impersonating Avast, aimed at users in Belgium, during its scam-hunting activity, and described it as noticeably more polished than most scam sites.
- [2]
The page tells the visitor that their Avast Premium Security subscription has renewed for EUR 129.99, that it covers five devices, and that it will renew again the following February.
- [3]
The page includes a green tick, a status badge reading Active, and a tidy summary table laying out the amount, the payment method and the dates.
- [4]
The page is written in French for a Belgian audience.
- [5]
There is no subscription and no charge, and the page has no connection to Avast, whose branding is being used without permission.
- [6]
Alongside the renewal summary, a cancellation form asks for the visitor's full name, email address and Belgian mobile number, but nothing else.
- [7]
There is no password field and no request for card details on the page, which Malwarebytes said may be deliberate.
- [8]
Malwarebytes said a form asking only for a name, email address and phone number can feel harmless and is far easier to fill in than a login page.
- [9]
"The form is the lure, and the call is where the real danger begins."
- [10]
A working mobile number attached to a real name is exactly what a scammer needs for the next stage: calling the victim and posing as support staff.
- [11]
Collected details can be sold to other scammers or used for the next stage of the scam: a phone call from someone who tries to persuade the victim to install remote access software or to help reverse a payment that never happened.
- [12]
Malwarebytes said responding to a scam message makes contact details more valuable because it confirms the number is active and that the recipient is willing to engage.
- [13]
Filling in the form gives scammers a name, email address, phone number, and an indication that the person may respond to a call about a supposed antivirus payment.
- [14]
Antivirus renewal scams often begin with a message claiming that the subscription has automatically renewed; following the instructions to cancel it leads to a fake page designed to collect contact details, and the renewal charge never existed.
- [15]
Malwarebytes said receiving a message that names your antivirus software does not necessarily mean the sender has access to your device or account, because scammers impersonate popular brands and send the same message to large numbers of people knowing some recipients will be customers.
- [16]
The page was left with two notes in its code that were never meant for victims, both written in polite French and addressed to whoever had commissioned the work, explaining that the form did not yet send anything anywhere and that a real submission process would need to be connected later.
- [17]
Malwarebytes said the notes read like a contractor handing over an unfinished job rather than a scammer leaving a reminder, and that the courteous, second-person summary of what still needs doing is very much how an AI assistant signs off.
- [18]
The code contained unused styling for a section that had been removed, which Malwarebytes said suggests the page had been created in stages without a final review.
- [19]
The copy was grammatically correct but vague, describing the benefits of the subscription across four paragraphs without mentioning any specific Avast features such as its firewall, VPN or ransomware protection.
- [20]
Malwarebytes said generated code carries no watermark, so AI authorship cannot be proven from the files alone.
- [21]
The form on the page sent nothing at all.
- [22]
Malwarebytes said two pieces of text would have displayed as visible gibberish if anyone had opened the page in a browser, suggesting nobody had.
- [23]
Malwarebytes said what it was looking at was most likely half-built, or possibly a template waiting to be sold on to someone who would add a destination for the stolen details.
- [24]
A completed submission would have yielded four items to the operator, and this build delivered zero of them.
- [25]
Malwarebytes said building a page like this used to take a certain amount of skill, which limited how many of them could be made, and that AI has lowered that barrier.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comScammers leave AI fingerprints all over fake antivirus renewal page
1 article · September 17, 2026
- malwarebytes.comAI helps scammers build convincing antivirus renewal pages
1 article · September 16, 2026
Topics and entities
Topics
- AI-Assisted Cybercrime
- Antivirus renewal scams
- Phishing
Entities
- Avast
- Avast Premium Security
- Help Net Security
- Malwarebytes