Threat Actors Using Fake Avast Website to Harvest Users Credit Card Details
A recent phishing campaign has been identified, targeting users by impersonating the cybersecurity firm Avast. This operation's primary objective is to acquire sensitive financial details by deceiving users into believing they are addressing a fictitious…
A recent phishing campaign has been identified, targeting users by impersonating the cybersecurity firm Avast. This operation's primary objective is to acquire sensitive financial details by deceiving users into believing they are addressing a fictitious charge.
The attackers employ a fraudulent website that closely mimics the authentic Avast portal, using official color schemes to establish credibility. The site displays a fabricated transaction record indicating a debit of €499.99, creating urgency by stating that cancellation requests must be filed within 72 hours, while transactions older than 48 hours are irreversible.
The phishing page incorporates dynamic scripting to enhance its impact. A specific JavaScript line reads the local system clock to insert the current date into the transaction record, thereby increasing the urgency of the situation. The site loads the official Avast logo from the vendor's content delivery network to enhance authenticity.
A recent phishing campaign has been identified, targeting users by impersonating the cybersecurity firm Avast.
The scam's technical infrastructure is designed to efficiently validate and exfiltrate data. Users are prompted to submit their personal contact details, followed by a request for full credit card information. The Luhn algorithm is used within the page's code to validate the entered credit card number in real-time, ensuring only valid card formats are accepted. This data is then transmitted via a POST request to a backend file named send.php .
To mitigate such threats, users are advised to:
Recognize the warning signs of refund fraud. Legitimate vendors will not request a full credit card number and security code for refunds. Verify suspicious charges by visiting the company's official website directly instead of using unsolicited links. Contact their bank immediately if they have entered their details, to cancel the compromised card and dispute any pending charges. Change passwords for any accounts associated with the email address provided to the scammers. Regularly update operating systems and applications, and run comprehensive scans with reputable security software.
Based on reporting by Cyber Security News.