A fake renewal page can collect your name, email, and phone number even when no charge exists. Check your bank and antivirus account directly before responding.
In 60 seconds
- Anyone receiving an antivirus renewal message should check it, whether or not they use the named brand.
- Check your bank or card statement and antivirus account through official channels, not the message link.
- If you entered contact details, expect a possible follow-up call and do not install remote access software.
- A polished page, familiar logo, or fluent writing does not prove a renewal notice is genuine.
Who should care and what to do today
This can affect anyone who receives a message saying an antivirus subscription has renewed, whether or not they use the named brand. Malwarebytes says scammers can send the same message widely and hope some recipients recognize the software.
If the message says money was taken, check your bank or card statement by opening the bank’s app or typing its address yourself. Then check your antivirus subscription through the company’s official app or website. Do not click the link in the message.
Do not complete a cancellation form that mainly asks for your name, email address, and phone number. If you already submitted those details, treat an unexpected call about the supposed payment as suspicious. You do not have to answer or continue the conversation.
The fake Avast page Malwarebytes found
Malwarebytes reported a fake Avast renewal page aimed at users in Belgium. It claimed that an Avast Premium Security subscription had renewed for €129.99 and covered five devices. The page showed a payment summary, dates, a green tick, and an “Active” badge.
The page was not connected to Avast. Malwarebytes said there was no real subscription and no real charge. Its cancellation form requested a full name, email address, and Belgian mobile number, but not a password or card number.
That can make the form seem harmless. But a real name and working phone number can help a scammer make a later call sound believable. Malwarebytes said the next step may involve someone pretending to be support staff and asking the person to install remote access software, which lets another person view or control a device from a distance.
Why the page looked convincing
The page used fluent French and a polished layout. Malwarebytes found code notes and other clues that suggested artificial intelligence, or AI—software that can generate text and computer code, may have helped build it. The report said that conclusion could not be proven from the files alone.
Malwarebytes also reported that this particular form did not send submitted information anywhere. The page appeared unfinished, or possibly like a template waiting for someone to connect it to a data collection system. That does not make the message safe to follow.
Older warning signs included spelling mistakes, poor layouts, odd currencies, or stretched logos. Those clues may be less useful now because scammers can copy real logos and produce polished pages. Focus on the situation instead: an unexpected renewal, pressure to cancel, and a request for your contact details.
If you already shared information or installed software
If you only opened the page, close it and do not enter information. If you submitted your name, email address, or phone number, be cautious with calls that refer to the supposed renewal. Do not install software because an unexpected caller tells you to.
If you installed remote access software during such a call, disconnect the device from the internet, remove the software the caller requested, and change your passwords from a different device. If you sent money or shared card details, contact your bank immediately.
These steps are general safety advice based on the response guidance in the Malwarebytes report. Its specific example was a fake Avast page; the report did not identify an Avast security flaw or an affected software version.
Does this affect me?
- Who may be affected
- Anyone who receives an antivirus renewal message, whether or not they use the named brand. Malwarebytes’ reported example impersonated Avast and targeted users in Belgium.
- How to check
- Check your bank or card statement and the antivirus account through the official app or website, opened independently of the message.
- What to do
- If no matching charge appears, stop responding to the message and ignore unexpected follow-up calls about it.
- What to avoid
- Do not click the message link, submit contact details to a cancellation form, or install remote access software for an unexpected caller.
Common questions
What if the message names the antivirus I actually use?
That still does not prove it is genuine. Malwarebytes says scammers can impersonate popular brands and send the same message to many people. Check the subscription in the company’s official app or website, and check your bank or card statement directly.
What if I entered my name, email address, and phone number?
Be prepared for a possible scam call about the supposed payment. Do not give the caller more information or install remote access software. If you installed software during the call, disconnect the device from the internet, remove the requested software, and change passwords from a different device.
Does a polished page prove artificial intelligence made it?
No. Malwarebytes found signs consistent with AI-generated code and writing, but said that could not be proven from the files alone. The safer lesson is that clean design and fluent writing do not prove a page is genuine.
Primary source
This article is based on Malwarebytes, “AI helps scammers build convincing antivirus renewal pages,” published September 16, 2026: https://www.malwarebytes.com/blog/threat-intel/2026/09/ai-helps-scammers-build-convincing-antivirus-renewal-pages. The reported example does not establish a flaw in Avast or an affected software version. Read the complete original source.
Concerned this may affect your computer or account?
Bring the exact alert, device, product, and timeline. Leon will help separate urgent action from noise.
Article history: Published Sep 16, 2026 at 11:25 am EDT. Updates and corrections are noted here when material facts change.
