One in three brand-phishing lures now poses as Microsoft, Check Point warns; fake AI tool emails emerge

Cybercriminals disguised their phishing messages as Microsoft in one of every three brand-phishing lures, or brand-impersonation attempts, between July and September 2026, according to the latest quarterly ranking from Israeli security firm Check Point Research. The software giant’s share climbed to 33%, from about 23% in the April–June quarter.

Apple and Google shared second place at 8% apiece, with LinkedIn at 6% and Amazon at 4% completing the top five. Together those five names accounted for more than half of all the impersonation attempts the firm recorded. YouTube moved up to sixth and Dropbox jumped into eighth, the report said.

Why Microsoft is the favourite target

Check Point explained the preference simply: “stolen Microsoft credentials can unlock an entire corporate environment.” A single work login typically opens email, shared files and collaboration tools, whereas many other popular brands lead mainly to personal accounts. “Brand phishing is entering a new phase,” said Omer Dembinsky, data research manager at Check Point Research.

That reasoning matters in Hyderabad, where many of the city’s hundreds of thousands of IT and services employees work inside corporate Microsoft 365 accounts. The report does not break down figures by country, so there is no data on how many of these attempts reached Indian users.

AI and developer tools now in the frame

The researchers flagged lures built around newer platforms. One email, seen in October, carried the subject line “Payment failed for your Claude account”, claimed a €500 charge for Anthropic’s AI service had been declined and threatened to pause API access and team seats. Its “Update payment method” button led to a page harvesting card details and login credentials.

A second campaign used a lookalike domain, registered in September, posing as Google’s Antigravity coding platform. It offered a Linux installation command that quietly decoded a hidden instruction, fetched a script from an outside server and ran it, handing attackers control of the machine. Other fakes imitated Apple support pages urging Mac owners to paste terminal commands, and Docusign prompts that installed remote-access software.

Check Point said attackers are shifting from stealing passwords alone to persuading victims to run commands or install tools themselves, and urged organisations to block phishing before it lands in inboxes.

How to spot a fake

• Check the sender’s domain. Look at the full address, not the display name; billing notices from odd domains are a red flag.
• Never sign in from an email link. Type the service’s address yourself or use its app before entering a password or card number.
• Don’t paste commands you were sent. Install software only from official sources.
• Turn on multi-factor authentication for work and personal accounts.
• Report it. Tell your company’s IT or security team; if you have lost money or data, report at cybercrime.gov.in or call the national helpline 1930.

Also read: Fake WhatsApp on Play Store tops 5 lakh downloads: how to check you have the real app · Consumer watchdog pulls 3,940 explosive-chemical listings off seven trading websites