Fake Antivirus Sites Spread Malware Disguised as Avast, Malwarebytes, Bitdefender

Trellix researchers discovered several professional-looking fake antivirus websites (impersonating Avast, Bitdefender, Malwarebytes) that distribute malicious installers and APKs—including SpyNote, Lumma, StealC and an obfuscated AMCoreDat.exe—that harvest credentials, tokens, browsing data and system profiles and exfiltrate them to attacker C2 servers, creating risks of identity theft, financial loss and follow-on ransomware; recommended mitigations include verifying software sources, avoiding pirated software, and using reputable endpoint security.