Why One Brand Gets Impersonated in a Third of Phishing Attempts

You have probably had the email. A payment failed, an account is on hold, and a button says Update payment method. You didn't click, mostly because you've never had an account with that company. Yet the name in the sender line keeps turning out to be the same one, over and over.

Check Point Research's Q3 2026 Brand Phishing Report says Microsoft accounted for 33% of the brand impersonation attempts it tracked, up from 23% in the previous quarter. That is roughly four times the share of any other brand, according to the report. The likely reason is what a stolen Microsoft login is worth, rather than any difficulty in copying the brand. The newest lures in the report have also started asking for something other than a password.

What did the report actually find?

The report was published on 16 October 2026. Its ranking puts Microsoft first on 33%, followed by Apple and Google on 8% each and LinkedIn on 6%. Amazon also makes the top five, though the text gives no figure for it. YouTube climbed five places and Dropbox climbed ten to enter the top 10. Check Point says the top five brands together made up more than half of all attempts, and that technology was the most impersonated industry, followed by social networks and banking.

So the headline is concentration. A small number of household names carry most of the impersonation effort, and one of them carries a third of it on its own.

Why would one brand attract a third of the effort?

Think about which key a burglar would rather copy. A key to one flat opens one flat. A key to the building's management office opens every door in the block. Attackers choosing a brand to impersonate are making a similar calculation.

Check Point's own explanation is that stolen Microsoft credentials can open up a whole corporate environment, including email, files and collaboration tools, while many of the other leading brands mainly lead to personal accounts. That is the vendor's reading of its data rather than a measured fact about attacker intent, but it fits the shape of the numbers. A work login is a bigger prize than a streaming login.

Is it all just fake sign-in pages?

This is where the report gets interesting, because several of its examples never mention a password.

One was an October 2026 email with the subject "Payment failed for your Claude account". It claimed a payment of 500.00 euros had been declined and warned that API access and seats would be paused, then pointed to an Update payment method button. The sender domain was account-notif[.]com.

Another was a site registered in September 2026 at antigravity-ide-google[.]com, imitating a Google developer tool. It showed a Linux install command that decoded a Base64 payload and ran a remote shell script. A third, apple-support[.]today, copied Apple's support site and offered an article called "Boost your Mac using the terminal", which pushed readers to run commands. The legitimate address, as the report notes, is support.apple.com.

A fourth was a cluster of Docusign lookalike sites showing a fake "Update Required" prompt. Clicking Continue downloaded an installer for a legitimate remote management tool. Check Point says that suggests an attempt to gain unauthorised remote access. Nothing in the tool itself is malicious, which is exactly why it is useful to an attacker.

Here is the turn. We usually picture brand phishing as a copied login page that collects a password. In these examples the brand is only the costume. The request has changed from "type your credentials" to "run this" or "install this", and the person doing it is the one who opens the door.

What does the report not tell us?

Quite a lot, and it is worth saying so. The page does not explain its method. It says only that the figures cover brand impersonation attempts tracked by Check Point Research, with no sample size, data sources or counting rules. It also measures attempts, not successful compromises, so a high share does not mean those attacks worked more often. Treat 33% as a useful signal from one vendor's telemetry, not as a census of all phishing. We have left out the report's product performance claims, which are the vendor's own and unverified here.

What should people and organisations do about it?

The advice is calm and mostly small. For individuals, go to the service directly instead of using the button in a message. A genuine billing problem will also show up when you sign in the normal way. Treat any page that tells you to paste a command into a terminal or the Windows Run box as a stop sign, unless your own IT team sent you there. The same goes for an installer offered by a document-signing or support page you did not go looking for.

For organisations, the report suggests stopping phishing messages before they reach inboxes, protecting Microsoft 365 and Google Workspace consistently, and monitoring for unapproved remote management software. That last point matters because the software in the Docusign example would look ordinary on a device list. It is worth knowing which remote tools your own teams are meant to be using, so anything else stands out.

The people side matters just as much. These lures work because they look like routine admin, and routine admin is what busy people deal with all day. Give staff a quick, blame-free way to report anything odd, and treat each report as useful information. Awareness training will not stop every attempt, but people who know what an unusual request looks like are a real layer of defence.

Source: Check Point Blog, "Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation", 16 October 2026.

Key takeaways

• Check Point Research says Microsoft made up 33% of tracked brand impersonation attempts in Q3 2026, up from 23% in Q2.
• A work login opens email, files and collaboration tools, which is the likely reason one brand attracts so much attention.
• Several lures in the report ask people to run a command or install software instead of typing a password.
• The report gives no method or sample size, and counts attempts rather than successful attacks.
• Go to services directly, never paste commands from a webpage, and know which remote tools your organisation actually uses.

Frequently asked questions

Does this mean Microsoft has a security problem?

No. The report counts how often attackers pretend to be Microsoft, not whether Microsoft was breached. The brand is chosen because people recognise it and because a work account is valuable.

Why do some lures ask me to run a command?

A person who runs a command or installs a program does the attacker's work for them, and no fake login page is needed. The brand name gives the request enough credibility to be followed.

Is the remote management tool in the Docusign example dangerous?

The tool itself is legitimate. Check Point's concern is that an attacker could use it to gain unauthorised remote access once a victim installs it, which is why unexpected remote tools deserve attention.

How reliable is the 33% figure?

It comes from one security vendor's telemetry, and the report does not describe its method or sample size. It is a good indicator of direction, not a precise measure of all phishing.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.