Refund scam impersonates Avast to harvest credit card details

This report documents a phishing campaign impersonating Avast that presents a fake €499.99 refund to coerce users into entering personal and full credit card details (number, expiry, CVV) on a fraudulent web form; the page uses Avast-branded assets, dynamic date insertion, Luhn validation to accept structurally valid cards, and an embedded Tawk.to live chat to actively coax victims, then sends the collected data via a POST to send.php and encourages users to uninstall security software.