SaneSecurity offers unofficial phishing and scam signatures for ClamAV. The usage page lists a variety of download scripts. I opted for the "download script 1". This script requires the ClamAV command line interface and Curl for operation. The clamav and curl packages fulfil these requirements on Debian.