Microsoft Dominates Brand Impersonation in Phishing Attacks, Check Point Reports
Microsoft was the most impersonated brand in phishing attacks during Q3 2026, accounting for 33% of attempts, a significant increase from the previous quarter, according to Check Point Research.
Microsoft has emerged as the most frequently impersonated brand in phishing attacks during the third quarter of 2026, according to a new report by Check Point Research. The tech giant accounted for a substantial 33% of all brand impersonation attempts, marking a significant increase from the 23% observed in the preceding quarter. This dominance places Microsoft far ahead of other targeted brands, with Apple and Google each representing only 8% of impersonation attempts.
The research highlights that attackers favor impersonating Microsoft due to the potential for stolen credentials to grant access to extensive corporate environments. Unlike many other top brands that primarily lead to personal accounts, compromised Microsoft credentials can unlock access to a wide array of systems, including email, sensitive files, and collaboration tools, making them a more valuable target for cybercriminals.
Beyond Microsoft, Apple, and Google, the report also noted significant rises in impersonation attempts targeting Dropbox and YouTube. Technology brands, in general, were the most common targets for impersonation, followed by social networks and banking institutions. This trend underscores the continued reliance on technology platforms for both personal and professional activities, making them prime targets for credential theft.
The report also detailed specific tactics used by attackers, including the impersonation of AI and developer tools. One example involved a phishing email leveraging Claude and Anthropic branding, falsely claiming a €500 payment had been declined and warning of service interruptions unless payment details and account credentials were updated. Another instance saw a website impersonating Google Antigravity, a platform for agentic software development, which was used to download and execute malicious code on victim computers.
Fake support pages and software update lures were also prevalent. A website mimicking Apple's branding and support content promised performance improvements for Macs via terminal commands, enticing users to run malicious scripts. Similarly, fake Docusign websites appeared, prompting users to "Update Required" for a Docusign Reader, which in turn downloaded the FleetDeck remote monitoring and management product, a tool that can be abused for unauthorized device access.
These findings indicate a sophisticated and evolving phishing landscape where attackers are leveraging brand recognition and the perceived legitimacy of popular services to trick users into compromising their accounts and devices. The broad reach and critical functions associated with Microsoft's ecosystem make it a particularly attractive target for these malicious campaigns.
The consistent targeting of major technology brands underscores the importance of user vigilance and robust security measures. Organizations and individuals alike must remain cautious of unsolicited communications and verify the authenticity of login pages and software updates to protect against these pervasive threats.