Microsoft is now one in three brand phishing attempts — and the fakes ask victims to run the attack themselves

Check Point Research’s Q3 2026 Brand Phishing Report, published on 16 October, puts Microsoft at 33% of all brand impersonation attempts it tracked in the quarter — up from 23% in Q2, and roughly four times the share of any other brand.

The ranking

Apple rose two places to second with 8%, tied with Google; LinkedIn fell two places to fourth with 6%. With Amazon completing the top five, those brands accounted for more than half of all attempts. Dropbox jumped ten places into eighth and YouTube rose five places to sixth, both entering the top ten. By sector, technology brands were impersonated most, followed by social networks and banking — in Check Point’s words, the places “where people keep their most valuable accounts”.

Check Point’s explanation for Microsoft’s lead is straightforward: stolen Microsoft credentials “can unlock an entire corporate environment”, while most other top brands lead mainly to personal accounts.

The method is changing

The ranking is the headline. The examples in the report are the more useful part, because several of them do not steal a password at all. They persuade the victim to run the attack.

• Apple. apple-support[.]today, registered in September 2026, imitates Apple’s site down to navigation and branding. Its article “Boost your Mac using the terminal” invites users to paste commands into their own machines. The genuine support site is support.apple.com.
• Google Antigravity. antigravity-ide-google[.]com, also registered in September, impersonates Google’s agentic development platform and shows a Linux install command that decodes and runs a Base64-encoded instruction, downloading a script that gives the attacker remote code execution.
• Docusign. A cluster of lookalikes registered from September into October — starting with docusigninstalleradmin[.]help — shows a document awaiting signature and an “Update Required” prompt for a “Docusign Reader”. Clicking Continue downloads an installer for FleetDeck, a legitimate remote-management tool, handing the attacker remote access.
• Claude. An October email from billing-update@account-notif[.]com under Claude and Anthropic branding claims a €500 payment failed and that API access will be paused unless the payment method is updated.

Two patterns run through these. The fakes copy the pages where customers expect to receive instructions from a brand — support articles, install pages, billing notices, document workflows. And the domains were registered weeks before the campaigns were observed.

What this means for you

The concentration in five giants is not reassurance for everyone else. Attackers go where trust converts; for most brands that is a smaller customer base, but the same playbook — copy the support page, the billing email, the “download our app” button — works on any audience that acts on a brand’s instructions. In our own work, the iGaming, fintech and trading brands we protect see exactly these formats: fake “official” apps, cloned login and deposit pages, and support channels that ask users to install something.

Three things follow:

• Watch the pages people follow, not just the homepage. Support articles, download pages, payment notices and login flows are what get copied. Monitor for lookalikes of those specifically.
• Treat new registrations as the early warning. Lookalike domains using your name are usually registered before they go live. Acting while a site is parked or half-built is faster and cheaper than chasing a running campaign.
• Publish what is genuine. A single page listing your official domains, apps and support channels — as Apple’s real support domain is cited in the report — gives customers, platforms and hosts a reference to measure fakes against.