Microsoft Leads Brand Phishing Targets in Q3 2026, Check Point Data Shows

Microsoft was the most impersonated brand in phishing campaigns during the third quarter of 2026, according to research from Check Point Research. The company accounted for 33% of all brand impersonation attempts tracked during that period. This figure represents a significant increase from the 23% share Microsoft held in the previous quarter. The data indicates that Microsoft’s share was roughly four times larger than that of any other single brand.

The research team explained that attackers prioritize Microsoft because stolen credentials for its services can provide access to an entire corporate environment. This includes email systems, file storage, and collaboration tools. In contrast, credentials for many other top impersonated brands typically lead only to personal accounts. Technology brands were the most frequently impersonated category overall, followed by social networks and banking institutions.

Emerging Tactics and New Targets

Apple and Google each followed Microsoft with 8% of the impersonation attempts. Dropbox and YouTube recorded the largest climbs in the rankings during the quarter. While technology brands remained the primary focus, researchers identified several sophisticated campaigns targeting other services in late 2026. These campaigns employed specific social engineering tactics to trick users into executing malicious code or surrendering payment details.

A phishing email sent in October 2026 used branding associated with Claude and Anthropic to claim that a €500 payment had been declined. The message, which carried the subject line “Payment failed for your Claude account,” warned recipients that their API access and Claude seats would be paused. It urged users to update their payment method to avoid service interruption. Clicking the “Update payment method” button led to a process designed to collect payment details and account credentials.

Malware Distribution via Fake Updates

Researchers also identified websites registered in September that impersonated Google Antigravity, a software development platform. One such site displayed a Linux installation command that decoded and ran a concealed instruction. This action downloaded and executed a script from an external server, allowing attackers to run code on the victim’s computer. Another site, registered in September, copied Apple’s support content and navigation menus. It directed visitors to an article titled “Boost your Mac using the terminal,” promising performance improvements to persuade users to run malicious commands.

Websites impersoning Docusign began appearing in September, with additional registrations in early October. One site displayed a document awaiting review and signature, accompanied by an “Update Required” prompt. This prompt claimed that a Docusign Reader update was necessary to open the document. Clicking “Continue” downloaded a FleetDeck installer. FleetDeck is a remote monitoring and management product that can be abused to access devices. Check Point stated that its distribution through a spoofed Docusign website suggested an attempt to gain unauthorized access to the victim’s computer.

What should you do?

Security teams should monitor for unauthorized remote management tools being installed on endpoints. FleetDeck and similar enterprise products can be leveraged by attackers if distributed through phishing campaigns. Organizations should also verify the legitimacy of payment failure notifications, particularly those related to API services or subscription seats. Users should be trained to recognize that legitimate services rarely demand immediate payment updates via email links.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: Microsoft

• Verify the source of any email claiming a payment failure or service suspension by contacting the vendor through official channels, not via links in the message.
• Scan endpoints for unauthorized remote monitoring or management tools, such as FleetDeck, that may have been installed via malicious installers.
• Educate users to avoid executing terminal commands or installing software based on promises of performance improvements found on unofficial support sites.
• Monitor for unusual login activity or credential usage patterns that might indicate compromised Microsoft or other high-value corporate accounts.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which brand was most targeted in phishing attacks in Q3 2026?

Microsoft was the most targeted brand, accounting for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026.

Why do attackers prefer Microsoft credentials?

Attackers favor Microsoft because stolen credentials can unlock an entire corporate environment, including email, files, and collaboration tools, rather than just personal accounts.

What is FleetDeck and how was it used in these attacks?

FleetDeck is a remote monitoring and management product. It was distributed via spoofed Docusign websites to gain unauthorized access to victims' computers.