Microsoft Accounts for One in Three Brand Phishing Attempts in Q3 2026

Check Point Research finds attackers increasingly impersonating AI and developer platforms, using fake billing alerts, malicious commands and remote access tools to compromise victims.

Microsoft accounted for 33% of brand phishing attempts tracked globally in the third quarter of 2026, up from 23% in the previous quarter, as cybercriminals intensified efforts to exploit trust in established technology brands, according to Check Point Research (CPR).

Apple ranked second with an 8% share, tied with Google, which also accounted for 8%. LinkedIn followed at 6%, while Amazon completed the top five at 4%. Together, these five brands represented more than half of all brand impersonation attempts tracked during the quarter.

Technology remained the most impersonated industry, followed by social networks and banking, reflecting attackers’ continued focus on accounts containing valuable business, personal and financial information.

However, CPR’s latest Brand Phishing Ranking points to a shift in attack methods. Cybercriminals are increasingly targeting AI and developer platforms, including Claude and Google Antigravity, using fake payment notifications and malicious installation instructions. Some campaigns attempt to gain control of devices rather than simply steal login credentials.

One campaign impersonated Claude through an email claiming that a €500 payment had failed. Recipients were warned that their API access and Claude seats would be suspended unless they updated their payment details, creating urgency to obtain financial information and account credentials.

Another campaign used a counterfeit Google Antigravity website to distribute what appeared to be a legitimate Linux installation command. Instead, the command decoded and executed a Base64-encoded instruction that downloaded a shell script from an external server, potentially giving attackers remote code execution.

“Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves.” — Omer Dembinsky, Data Research Manager, Check Point Research

In a separate campaign, a fake Apple support page persuaded Mac users to run terminal commands under the pretext of improving performance. Attackers also used a spoofed DocuSign website to present a document requiring a supposed reader update. Clicking the continuation prompt downloaded FleetDeck, a legitimate remote monitoring and management tool that could be abused for unauthorised access.

Omer Dembinsky, Data Research Manager at Check Point Research, said generative AI was making convincing emails and cloned websites easier to produce at scale, while attackers were moving beyond password theft towards malicious commands and remote access software.

The findings underline the growing difficulty of containing brand phishing, which exploits familiar logos, lookalike domains and urgent messages to lower users’ guard. Even legitimate software can become part of an attack when victims are manipulated into installing it.

CPR recommends a prevention-first approach, combining email and web security, AI-powered detection of brand impersonation, automated investigation and response, and monitoring for unauthorised remote management tools. Organisations should also scan for fraudulent domains and cloned login pages to help identify and remove threats before users engage with them.