If a phishing email pretends to come from a well-known company, the odds are now about one in three that it says Microsoft. That is the main finding of Check Point Research's Brand Phishing Ranking for the third quarter of 2026, which the company published on its blog on October 16. Trade outlets covered it on October 19.
Check Point says Microsoft accounted for 33% of brand impersonation attempts in Q3, up from 23% in Q2. That is roughly four times the share of any other brand on the list. The report also describes a change in what the lures look like: more of them now pose as AI services and developer tools, and they try to get the victim to run something on their own machine, not just type a password into a fake login page.
One caveat before the details. This is vendor research. The percentages describe the brand phishing attempts that Check Point Research tracked, not phishing across the whole internet, and we could not independently check the underlying data. Read it as a strong signal from one large security vendor, not a census.
The Leaderboard
According to Check Point, the top five most-impersonated brands in Q3 were:
- Microsoft — 33% (up from 23% in Q2)
- Apple — 8%, up two places to second
- Google — 8%, tied with Apple in third
- LinkedIn — 6%, down two places to fourth
- Amazon — 4%, fifth
Together those five brands made up more than half of all brand phishing attempts Check Point tracked. Further down the list, the biggest movers were Dropbox, which climbed ten places to eighth, and YouTube, which rose five places to sixth. Help Net Security also flagged those two as the quarter's biggest climbers.
By industry, technology was the most-impersonated sector, followed by social networks and then banking.
Why Microsoft, and Why Now
Check Point's explanation for Microsoft's lead is about what a stolen login is worth. As Help Net Security reported, the Check Point research team said stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, while many of the other top brands mainly lead to personal accounts. For a criminal, one working Microsoft 365 password can mean access to a company's inbox, shared documents and internal chat. That access can then be used for invoice fraud, data theft, or phishing other people from a trusted account.
The sources don't give a single reason for the jump from 23% to 33% in one quarter. They do agree that the reward from stealing a Microsoft account is large, which is why attackers keep coming back to it.
The New Lures: AI Tools and "Just Run This Command"
The most notable part of the report isn't the rankings. It's the examples. Security MEA described it as a shift in tactics, with attackers following users into AI and developer tools, and Check Point's own case studies show what that looks like:
- A fake Claude billing notice. An email titled "Payment failed for your Claude account" claimed a EUR 500 payment had been declined and warned that API access and Claude seats would be paused unless the recipient updated their payment method. Check Point notes this one was sent in October, after the Q3 reporting period ended, so it isn't counted in the quarter's numbers. It is included as a sign of where things are going.
- A Google Antigravity lookalike. In September, attackers registered a site imitating Google's Antigravity developer tool. According to Check Point, the page displayed an installation command that looked legitimate but actually decoded and ran a concealed instruction, so a developer who thought they were installing the real tool would be running the attacker's code.
- A fake Apple support page. A site registered in September copied Apple's branding and support content and offered an article titled "Boost your Mac using the terminal," which Check Point says was meant to get users to run malicious commands on their own systems.
- Docusign lookalikes that install remote-management software. Fake Docusign pages, registered from September into early October, claimed a Docusign Reader update was needed and downloaded an installer for FleetDeck, a legitimate remote monitoring and management product. Check Point said that distributing it through a spoofed Docusign site suggests an attempt to gain unauthorized remote access to the victim's device.
The pattern matters because it gets around some of the defenses organizations have spent years building. A stolen password can be blunted by multi-factor authentication. A victim who runs a command or installs remote-access software has handed the attacker a foothold on the device itself. In that case MFA on the account may not help much, and the activity can look like the user's own normal behavior.
The AI angle makes sense too. Developers and knowledge workers are trying out new AI assistants and coding tools quickly, often signing up with a company card and installing tools from instructions on a web page. A believable billing scare or a polished copy of a download page fits right into that routine. That is ZeroDayFeed's reading, not a finding from the report.
What It Means for Defenders
Who is affected: Any organization that runs on Microsoft 365 is in the most heavily targeted group. Mac users, developers trying new AI or coding tools, and anyone who signs documents electronically are the targets of the newer lure styles described above.
The sources describe an ongoing campaign trend, not a software flaw, so there is no patch or fixed version to install. The practical steps below are ZeroDayFeed's guidance based on the techniques Check Point describes:
- Update awareness training to cover "run this command" lures. Most phishing training focuses on fake login pages. Staff, and developers in particular, should know that no real vendor support page or billing notice needs them to paste commands into a terminal. A page that asks for that should be treated as hostile.
- Control remote-management tools. The FleetDeck case shows attackers using legitimate remote-access software. Keep an approved list of remote management tools, block or alert on installs of anything else, and review endpoint logs for remote-access agents nobody asked for. Check Point's own advice includes monitoring for remote management tools IT has not approved.
- Restrict software installs on user endpoints. Where it's practical, take away local admin rights and route new developer and AI tool installs through an approved process, so a copied download page can't quietly put code on a machine.
- Protect Microsoft accounts like the keys they are. Since Check Point's reasoning is that Microsoft logins unlock email, files and collaboration tools, use phishing-resistant MFA where you can, watch for unusual sign-ins, and have a tested process for revoking sessions and resetting credentials when a user reports clicking something.
- Verify billing scares out of band. A "payment failed" email for an AI subscription or any other SaaS service should be checked by going straight to the vendor's site or your finance team, not by clicking the link in the message.
- Watch for lookalike domains. The Antigravity copy was a site registered in September. Check Point's advice includes scanning the wider web for lookalike domains and cloned pages. Domain-monitoring and web-filtering tools that flag newly registered or lookalike domains can help catch this kind of page before a user lands on it.
For contractors working through CMMC, these steps align with existing expectations around security awareness training, controlling what software runs on systems, and monitoring for unauthorized use. Users running attacker-supplied commands is the kind of risk those practices are meant to address.
