Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks
Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand.
Top 10 most impersonated brands in phishing attacks (Source: Check Point)
Apple and Google followed with 8% each. Dropbox and YouTube recorded the biggest climbs in the rankings.
“Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, while many of the other top brands mainly lead to personal accounts,” the research team explained.
Technology brands were impersonated most often, followed by social networks and banking.
Scammers impersonate AI and developer tools
A phishing email sent in October 2026 used Claude and Anthropic branding to claim that a €500 payment had been declined. This example occurred after the July–September reporting period. The message carried the subject line “Payment failed for your Claude account” and warned that API access and Claude seats would be paused unless the recipient updated their payment method.
Claude payment failure phishing email (Source: Check Point)
An “Update payment method” button led to a process designed to collect payment details and account credentials.
A website impersonating Google Antigravity, Google’s agentic software development platform, was registered in September. It displayed a Linux installation command that decoded and ran a concealed instruction. This downloaded and executed a script from an external server, enabling the attacker to run code on the victim’s computer.
Fake support pages and updates seek device access
Another website registered in September copied Apple’s branding, navigation menus, and support content. Visitors were directed to an article titled “Boost your Mac using the terminal.” It promised performance improvements to persuade users to run malicious commands.
Websites impersonating Docusign began appearing in September, with further registrations in early October. One displayed a document awaiting review and signature. An “Update Required” prompt claimed that a Docusign Reader update was needed to open it.
Clicking “Continue” downloaded a FleetDeck installer. FleetDeck is a remote monitoring and management product that can be abused to access devices. Check Point said its distribution through a spoofed Docusign website suggested an attempt to gain unauthorised access to the victim’s computer.
