Microsoft remains the most impersonated brand in phishing, Check Point finds
in plain words
Scammers often pretend to be famous companies to trick people into giving away passwords. A security research team says Microsoft was the company scammers copied most in the third quarter of 2026. Apple, Google, LinkedIn and Amazon came next on the list.
Full summary
Check Point Research says Microsoft was the most impersonated brand in phishing Impersonating a trusted party to steal data, often with look-alike domains. Full definition of phishing attacks in the third quarter of 2026, making up 33% of the brand impersonation attempts the firm tracked. That share rose from 23% in the second quarter. Check Point says attackers favor Microsoft because stolen Microsoft credentials can open an entire corporate environment, including email, files and collaboration tools, while many other popular brands mainly lead to personal accounts.
Apple moved up two places to second with 8% of attempts, and Google was third with 8%. LinkedIn was fourth with 6%, down two places, and Amazon held fifth with 4%. Check Point says these five brands together made up more than half of all attempts, which it presents as a sign that attackers rely heavily on a small group of trusted names.
The firm says technology was the most impersonated industry in the quarter, followed by social networks and banking. According to Check Point, that order reflects where people keep their most valuable accounts: work email and cloud storage, social profiles, and money.
The report also gives examples of quarter’s attacks that reached users of AI and developer tools such as Claude and Google Antigravity. It says some attackers go beyond stealing passwords by persuading victims to run terminal commands or install remote access software themselves.
As an example, Check Point describes a phishing email sent in October 2026 that impersonates Claude, the AI assistant made by Anthropic. The message claims a payment on the recipient’s account could not be processed and warns that API access and Claude seats will be paused unless the payment method is updated. An update button in the message leads recipients into a fraudulent payment process that puts financial details and account credentials at risk.