Microsoft accounted for 33% of all brand phishing attempts tracked in the third quarter, up from 23% in the previous quarter, as cybercriminals increasingly impersonate trusted technology companies and AI platforms to trick users, according to a report published by Check Point Research on Monday.
The report found that the five most impersonated brands were Microsoft, Apple, Google, LinkedIn and Amazon, which together represented more than half of all brand phishing attempts. Apple moved up two places to rank second, accounting for 8% of attempts, while Google also recorded 8%. LinkedIn followed with 6%, and Amazon accounted for 4%. Microsoft’s share was roughly four times that of any other individual brand.
The campaigns are also expanding beyond traditional attempts to steal passwords. Attackers are increasingly targeting AI and developer platforms, including Claude and Google Antigravity, using fake billing notifications, fraudulent websites and malicious installation instructions. Some scams attempt to persuade victims to execute commands in their computer’s terminal or install legitimate remote access software, potentially giving attackers access to their devices.
Technology remained the most impersonated industry during the quarter, followed by social networks and banking. These sectors are attractive targets because users rely on them for work accounts, cloud storage, personal profiles and financial services.
“Brand phishing is entering a new phase,” said Omer Dembinsky, data research manager at Check Point Research. He noted that attackers continue to exploit trust in familiar technology platforms while increasingly targeting AI tools and developer environments. Instead of simply stealing passwords, some campaigns now try to convince victims to execute malicious commands or install remote access software themselves.
The report also warned that generative AI is making it easier for cybercriminals to produce convincing phishing emails and cloned websites at scale. This increases the need for organisations to strengthen protection across email systems, web browsing and other channels through which employees and customers may encounter fraudulent content.
One campaign impersonated Claude by sending fake payment failure emails claiming that a €500 charge had been declined. The messages warned recipients that their API access and Claude seats would be suspended unless they updated their payment details. Victims who followed the instructions risked exposing their financial information and account credentials.
Another campaign used a fake Apple support article to persuade Mac users to run terminal commands under the promise of improving their device’s performance. Such tactics can be particularly dangerous because users may execute the instructions themselves, believing they are following legitimate technical guidance.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Check Point Research recommended that organisations block phishing messages before they reach users’ inboxes, use AI-powered detection to identify brand impersonation and credential theft, and automate security investigations and responses. It also advised businesses to monitor for unauthorised remote management tools and scan the web for lookalike domains and cloned login pages so fraudulent websites can be identified and taken down before more people interact with them.
Microsoft Leads Brand Phishing Attacks as AI Scams Evolve
