New Delhi, October 19, 2026 (Yes Punjab News)
Microsoft accounted for 33 per cent of all brand phishing attempts tracked in the third quarter of 2026, up from 23 per cent in the second quarter, as cybercriminals increasingly exploited trusted brands and expanded their tactics to target AI and developer platforms, according to a report released by Check Point Research on Monday.
The report found that the top five most impersonated brands — Microsoft, Apple, Google, LinkedIn and Amazon — collectively accounted for more than half of all brand impersonation attempts.
Apple climbed two places to rank second, accounting for 8 per cent of attempts, while Google also recorded an 8 per cent share. LinkedIn accounted for 6 per cent and Amazon for 4 per cent. Microsoft’s share was roughly four times that of any other brand.
Attackers also impersonated artificial intelligence and developer platforms, including Claude and Google Antigravity, using fake billing alerts and malicious installation commands, the report said.
Some campaigns went beyond stealing login credentials, persuading victims to execute terminal commands or install legitimate remote-access software themselves.
At the industry level, technology remained the most impersonated sector, followed by social networks and banking. These sectors hold valuable user information, including work emails, cloud storage, social media accounts and financial details, the report noted.
“Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves,” said Omer Dembinsky, Data Research Manager at Check Point Research.
Dembinsky said generative AI had made it easier to produce convincing emails and cloned websites on a large scale. He stressed the need for organisations to implement preventive measures covering both email inboxes and the wider web.
The report highlighted a campaign impersonating Claude through a fraudulent payment-failure email claiming that a €500 charge had been declined. The message warned recipients that their API access and Claude seats would be suspended unless they updated their payment method, potentially exposing their financial information and account credentials.
In another campaign, attackers created a fake Apple support article encouraging Mac users to execute terminal commands under the promise of improving device performance.
The report urged organisations to strengthen their defences against such attacks by blocking phishing messages before they reach inboxes, deploying AI-powered detection to identify brand impersonation and credential theft, and automating investigation and response.
It also recommended monitoring for unauthorised remote-management tools and scanning the wider web for lookalike domains and cloned login pages so fraudulent sites can be identified and taken down before customers interact with them.
FOLLOW NOW
