A convincing fake Avast site displays a €499.99 charge and promises a refund. Instead, it harvests your name, address, and full credit card details.
The vulnerabilities could have let malicious users masquerade as agency officials, potentially misleading researchers, contractors and others.