Attackers are expanding into AI and developer platforms, using fake billing alerts, malicious commands and remote access tools to compromise victims.
Microsoft remained the most impersonated brand in the third quarter of 2026, accounting for 33% of all brand phishing attempts tracked by Check Point Research (CPR), up from 23% in Q2. The findings highlight how cybercriminals continue to exploit trust in established technology brands while extending their campaigns into artificial intelligence and developer tools.
According to CPR’s Q3 2026 Brand Phishing Ranking, Apple climbed two places to second with 8%, tied with Google in third. LinkedIn ranked fourth at 6%, while Amazon completed the top five with 4%. Collectively, these five brands accounted for more than half of recorded brand impersonation attempts, with Microsoft’s share roughly four times that of any other individual brand.
Technology remained the most impersonated sector, followed by social networks and banking. These industries offer access to valuable digital assets, including corporate email, cloud services, professional identities, personal accounts and financial information.
The report also identifies a shift in attackers’ methods. Beyond stealing passwords and payment details, cybercriminals are increasingly persuading victims to execute commands or install software that can provide direct access to their devices. AI and developer platforms, including Claude and Google Antigravity, featured in campaigns involving fraudulent billing messages and deceptive installation instructions.
“Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves. As generative AI makes convincing emails and cloned websites easier to produce at scale, organisations need prevention that reaches both the inbox and the wider web.” — Omer Dembinsky, Data Research Manager, Check Point Research
One campaign impersonated Claude through an email claiming that a €500 payment had failed. The message warned that API access and Claude seats would be suspended unless the recipient updated their payment details, using the threat of service disruption to encourage disclosure of sensitive information.
Another campaign used a lookalike Google Antigravity website to distribute what appeared to be a legitimate Linux installation command. The command instead decoded and executed a Base64-encoded instruction that downloaded a shell script from an external server, potentially enabling remote code execution on the victim’s system.
Attackers also created a fake Apple support article encouraging Mac users to run terminal commands under the pretext of improving performance. In a separate campaign, a spoofed Docusign website claimed that a document reader update was required. Clicking “Continue” downloaded FleetDeck, a legitimate remote monitoring and management tool that could be abused to gain unauthorised access to the device.
These campaigns demonstrate how familiar branding, urgency and apparently legitimate technical instructions can be combined to bypass user suspicion. Generative AI is further complicating the threat landscape by making convincing emails and cloned websites easier to produce at scale.
CPR recommends a prevention-first approach that blocks phishing messages before they reach inboxes, uses AI-powered detection to identify brand impersonation and credential harvesting, and automates investigation and response. Organisations should also monitor for unauthorised remote management tools and scan the web for lookalike domains and cloned login pages.
As phishing increasingly targets devices and systems rather than credentials alone, organisations must secure the entire path from email and web access to command execution and software installation.
