Microsoft remained the most impersonated brand in phishing attacks during the third quarter of 2026, accounting for 33 per cent of all brand phishing attempts tracked globally, up from 23 per cent in the second quarter, according to new research from Check Point Research.
Key Takeaways
- Microsoft was impersonated in 33% of all brand phishing attempts in Q3 2026, up from 23% in Q2.
- Apple and Google tied for third place at 8%, with LinkedIn and Amazon rounding out the top five.
- Attackers are now impersonating AI and developer platforms such as Claude and Google Antigravity using fake billing alerts and malicious install commands.
Microsoft’s share of impersonation attempts dwarfs rivals
Apple rose two places to rank second at 8 per cent, tied with Google in third, while LinkedIn fell two places to fourth with 6 per cent and Amazon completed the top five at 4 per cent. Together, the top five brands accounted for more than half of all brand impersonation attempts tracked, with Microsoft’s share roughly four times that of any other brand. Technology remained the most impersonated sector overall, followed by social networks and banking.
Phishing follows users into AI and developer tools
Beyond the ranking, Check Point said the quarter brought a shift in tactics, with attackers impersonating AI and developer platforms such as Claude and Google Antigravity through fake billing alerts and malicious installation commands. One campaign impersonated Claude with a fake payment failure email warning that API access would be paused unless payment details were updated. Another used a lookalike Google Antigravity site that ran a disguised script granting remote code execution once copied into a terminal.
“Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves,” said Mr Omer Dembinsky, Data Research Manager at Check Point Research.
What organisations should do
Check Point said campaigns also moved beyond credential theft, persuading victims to run terminal commands or install legitimate remote access software under false pretences. It recommended that organisations stop phishing messages before they reach inboxes, use AI-powered detection for brand impersonation, automate investigation and response, monitor for unapproved remote management tools, and scan the web for lookalike domains and cloned login pages.
