Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation

In Q3 2026, Microsoft was the most impersonated brand in phishing attacks, accounting for 33% of all brand impersonation attempts tracked by Check Point Research, up from 23% in Q2. Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, while many of the other top brands mainly lead to personal accounts. Apple, Google, LinkedIn and Amazon completed the top five, and together these brands made up more than half of all attempts, showing how heavily attackers lean on a small group of trusted names. This quarter also brought examples showing attackers follow users into AI and developer tools such as Claude and Google Antigravity, and how they go beyond stealing passwords by persuading victims to run terminal commands or install remote access software themselves.

Key Findings

• Microsoft’s lead grew sharply. Microsoft accounted for 33% of all brand phishing attempts, up from 23% in Q2 2026 and roughly four times the share of any other brand.
• Apple moved up to second place. Apple rose two places with 8%, tied with Google in third, while LinkedIn dropped two places to fourth with 6%.
• Dropbox and YouTube were the biggest climbers. Dropbox jumped ten places into eighth and YouTube rose five places to sixth, both entering the top 10 this quarter.
• Technology remained the most targeted industry. Attackers impersonated Technology brands most often, followed by Social Networks and Banking, the sectors where people keep their most valuable accounts.
• AI and developer tools became a new lure. Attackers impersonated Claude with a fake payment failure email and Google Antigravity with a malicious installation command, aiming at users who work with AI and coding platforms.

Which brands were most impersonated in phishing attacks in Q3 2026?

Microsoft led the Q3 2026 ranking by a wide margin, with a 33% share that is roughly four times that of Apple and Google in second and third place. The biggest movers further down the list were Dropbox, which climbed from outside the top 10 to eighth place, and YouTube, which rose five places to sixth.

Which industries did attackers impersonate most?

Technology was the most impersonated industry in Q3 2026, followed by Social Networks and Banking. That order reflects where people keep their most valuable accounts: work email and cloud storage, social profiles, and their money.

What did brand phishing attacks look like this quarter?

The examples below show the range of tactics Check Point Research observed, from a fake AI billing alert to lookalike support pages that trick visitors into running malicious commands on their own machines.

Claude: a fake payment failure email

A phishing email sent in October 2026 impersonates Claude, Anthropic’s AI assistant, and claims the recipient’s account payment could not be processed. The message comes from the unauthorized address billing-update@account-notif[.]com, uses Claude and Anthropic branding, and carries the subject line “Payment failed for your Claude account”. It states that a €500.00 payment for the current billing period was declined and warns that API access and Claude seats will be paused unless the payment method is updated. An “Update payment method” button adds urgency and leads recipients into a fraudulent payment update process, putting both their financial details and account credentials at risk.

Google Antigravity: a malicious installation command

The website antigravity-ide-google[.]com was registered in September 2026 and impersonates Google Antigravity, Google’s agentic software development platform. Visitors are shown a Linux installation command that looks legitimate but actually decodes and runs a Base64 encoded command. That command downloads and executes a shell script from an external server, giving the attacker remote code execution (RCE) on the victim’s system.

Apple: a fake support article that targets Mac users

The website apple-support[.]today was registered in September 2026 and closely imitates the official Apple website, complete with Apple branding, navigation menus and content about Mac performance. Visitors land on an article titled “Boost your Mac using the terminal”, which promises better performance through terminal commands, will a clear intention to get users to run malicious commands on their own systems. Because the page looks so much like Apple’s own site, users may assume the advice is genuine and endorsed by Apple. The legitimate Apple Support website is support.apple.com.

Docusign: a fake reader update that installs remote access software

A set of several websites with similar characteristics impersonating Docusign began registering the in September 2026 (first domain being docusigninstalleradmin[.]help),and continued into early October with several other similar websites (e.g. docusignsinstaller[.]help).. A recent active website shows what appears to be a document waiting for review and signature, together with an “Update Required” prompt claiming a Docusign Reader update is needed to open it. Clicking Continue downloads fleetdeck_installer, a remote management tool. FleetDeck is a legitimate remote monitoring and management (RMM) product, but distributing it through a spoofed Docusign site suggests the goal is to gain unauthorized remote access to the victim’s device.

How can organizations defend against brand phishing?

Brand impersonation works because it exploits trust in familiar names, not a flaw in software. As generative AI helps attackers produce convincing emails and fake websites at scale, these attacks will keep growing in volume and sophistication, which makes prevention far more valuable than cleanup. In practice, that means:

• Stopping phishing messages inline, before they reach an inbox.
• Using AI powered detection to catch brand impersonation, business email compromise, credential harvesting, QR code phishing and AI generated attacks more accurately than manual review can.
• Protecting Microsoft 365, Google Workspace and collaboration tools from one platform to reduce operational complexity.
• Automating investigation and response so security teams resolve real threats faster.
• Monitoring for remote management tools that IT has not approved, since attackers can abuse legitimate RMM software to gain access.

Check Point Email Security brings these capabilities together, combining inline prevention with AI powered threat detection to stop advanced phishing attacks before they reach users.

Protection also has to reach beyond the inbox, because most phishing pages begin as copies of real ones. Scanning the open, deep and dark web for lookalike domains and cloned login pages, backed by a fast takedown process, shuts fake sites down before customers hand over their credentials or card details. Check Point’s Exposure Management catches 66% of phishing attacks built on copied pages and resolves takedown requests with a 99%+ success rate, most within 12 hours.