According to Check Point Research data reported by Help Net Security, Microsoft was the most impersonated brand in phishing attacks during the third quarter of 2026, appearing in 33% of tracked brand impersonation attempts. That is up from 23% in the previous quarter and roughly four times the share of any other brand. Apple and Google followed with 8% each. Researchers said attackers favor Microsoft because stolen credentials can unlock corporate environments, including email, files, and collaboration tools, whereas many other top brands mainly lead to personal accounts. Technology brands were the most impersonated category, followed by social networks and banking.
Attackers also expanded into AI and developer tools. An October 2026 phishing email used Claude and Anthropic branding, with the subject line "Payment failed for your Claude account," claiming a €500 payment had been declined. An "Update payment method" button led to a process designed to collect payment details and account credentials. Separately, a website impersonating Google Antigravity, Google's agentic software development platform, was registered in September. It displayed a Linux installation command that decoded and ran a concealed instruction, downloading and executing a script from an external server to run code on the victim's machine.
Other campaigns relied on fake support pages and update prompts. One site copied Apple's branding and support content, directing visitors to an article titled "Boost your Mac using the terminal" that promised performance improvements in exchange for running malicious commands. Websites impersonating Docusign displayed a document awaiting review and an "Update Required" prompt that downloaded a FleetDeck installer. FleetDeck is a remote monitoring and management product that can be abused to access devices; Check Point said its distribution through a spoofed Docusign website suggested an attempt to gain unauthorized access to the victim's computer.