Key points
- Microsoft accounted for 33% of brand impersonation attempts in Q3 2026, up from 23% in Q2.
- Apple and Google each held an 8% share, while Dropbox and YouTube saw ranking increases.
- Attackers used fake support pages for Claude, Google Antigravity, Apple, and Docusign to steal credentials or install remote management tools.
Microsoft became the primary target for brand impersonation campaigns in the third quarter of 2026, according to Check Point Research. The vendor represented 33% of all tracked phishing attempts that copied brand identities, a significant rise from the 23% share recorded in the previous quarter. This volume was roughly four times higher than any other single brand, highlighting a concentrated attacker focus on enterprise environments.
The research team explained that attackers prefer Microsoft because stolen credentials can unlock entire corporate ecosystems, including email, files, and collaboration tools. In contrast, credentials for other top brands often lead only to personal accounts. Technology brands were impersonated most frequently overall, followed by social networks and banking institutions, indicating a broad but weighted threat landscape.
Emerging Impersonation Tactics
Attackers deployed sophisticated lures beyond standard credential harvesting in late 2026. A phishing email sent in October 2026 used Claude and Anthropic branding to claim a €500 payment had been declined. The message warned that API access and seats would be paused unless recipients updated their payment method, directing users to a fake site designed to collect financial details and login credentials.
Separate campaigns targeted developers and Mac users with malicious technical support pages. A site impersonating Google Antigravity, registered in September, displayed a Linux installation command that decoded and executed a concealed script from an external server. This allowed attackers to run arbitrary code on victim computers, moving beyond simple data theft to active system compromise.
Affected Platforms and Tools
Apple branding was copied on a website registered in September, featuring navigation menus and support content that appeared legitimate. Visitors were directed to an article titled “Boost your Mac using the terminal,” which promised performance improvements to persuade users to run malicious commands. This tactic leveraged trust in official support resources to bypass user skepticism.
Websites impersonating Docusign also appeared in September and early October. One site displayed a document awaiting signature and prompted users to update a “Docusign Reader.” Clicking continue downloaded a FleetDeck installer, a remote monitoring and management product. Check Point noted that distributing such tools via spoofed sites suggests an attempt to gain unauthorized, persistent access to victim devices.
Next steps
Organizations should monitor for unexpected remote management software installations and verify the source of any terminal commands provided via email or web links. Security teams must validate payment failure alerts through official channels rather than clicking links in unsolicited messages. Users should be trained to recognize that legitimate vendors rarely request terminal commands for performance boosts or urgent payment updates via unsolicited communications.
Signals worth monitoring
Teams usually detect these campaigns by reviewing outbound traffic for connections to newly registered domains or unexpected script downloads. Check whether users are executing terminal commands received via email or from unfamiliar web pages. Look for alerts related to remote management tools like FleetDeck being installed without IT approval. Monitor for spikes in failed login attempts followed by successful authentications from unusual locations, which may indicate credential compromise. Investigate any reports of payment failure emails that request immediate action, as these often lead to credential harvesting sites.
Background: Phishing
Phishing is a social engineering attack that tricks users into revealing credentials or installing malware through deceptive communications. It mimics trusted entities to bypass technical controls. Defense requires layered verification, strict identity protocols, and continuous user education to spot subtle anomalies in context and content.
Read the full guide: Phishing Defined: Anatomy of the Attack and Risk Reduction
What to do and how to stay safe: Microsoft
- Verify the authenticity of payment failure or account suspension alerts by logging into the service directly through a bookmarked URL, not via email links.
- Monitor endpoint logs for the installation of remote monitoring and management tools, especially if they appear outside of standard patching windows.
- Block access to newly registered domains that impersonate known brands, particularly those hosting technical support content or software downloads.
- Review email filters for messages containing instructions to run terminal commands or download executable files disguised as document viewers.
Step-by-step guide: Security Awareness Training Best Practices That Actually Work
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why do attackers target Microsoft more than other brands?
Stolen Microsoft credentials can unlock entire corporate environments, including email and collaboration tools, whereas other brands often lead only to personal accounts.
What tools did attackers distribute via Docusign impersonation sites?
Attackers distributed a FleetDeck installer, a remote monitoring and management product that can be abused to access devices.
Which brands saw the biggest climbs in phishing rankings in Q3 2026?
Dropbox and YouTube recorded the biggest climbs in the rankings of most impersonated brands.
