Summary
- Microsoft made up 33% of brand phishing attempts in Check Point’s Q3 dataset, up from 23% in Q2.
- Apple and Google each accounted for 8%, while the researchers describe AI and coding-tool impersonation.
- The percentages measure Check Point’s observations, not the entire global phishing market.
Microsoft accounted for 33% of the brand impersonation attempts observed by Check Point Research during the third quarter of 2026, up from 23% in the preceding quarter, according to analysis published on 16 October. The figures place a dominant enterprise identity provider ahead of consumer and professional platforms in the vendor’s monitored phishing dataset.
Apple and Google each represented 8% of the recorded brand attempts, with LinkedIn at 6%. The distribution reflects material collected through Check Point’s visibility and classification processes, not an independently measured census of every phishing message sent worldwide. Changes in collection coverage and detection methodology can affect comparisons, although the company presents the quarter-on-quarter rise as part of its observed trend.
Microsoft identities sit at the centre of many organisational workflows. A compromised account can, depending on configuration and privileges, expose email, documents, collaboration services, and routes into other applications using federated authentication. That makes the brand a plausible lure for campaigns seeking more than a single consumer account. The research does not establish what proportion of attempted impersonations resulted in stolen credentials or a business compromise.
Alongside its July–September rankings, Check Point illustrated more recent AI and development-tool lures using the names Claude and Google Antigravity. Its example of a Claude billing message dates from October, outside the measured third-quarter period. In the examples discussed by the researchers, attackers attempt to persuade recipients to act on a false account or installation problem. Some scenarios use malicious commands or remote access tools rather than relying solely on a lookalike sign-in form. These observations expand the apparent range of trusted brands used as bait, but do not mean that the genuine services were breached.
Identity risk extends beyond the brand on the page
A brand impersonation message can work through several different channels. Attackers may copy visual material, use lookalike domains, distribute invitations or documents, or try to steer a user towards an unrelated download. The shared element is the attempt to borrow trust from a recognised service. No particular channel can be inferred from the aggregate Microsoft percentage alone because it combines distinct campaigns in one reported dataset.
The business consequences depend on what an attacker obtains. A stolen password may be insufficient where the organisation enforces appropriate additional authentication, but stolen sessions, malicious consent grants, or successful remote access can create other paths to an account. A message that convinces a developer to execute a command may instead cross a workstation trust boundary. Those differences mean that the same phishing category can conceal quite different investigation requirements.
Quarterly brand rankings can inform the way awareness programmes are designed, but they are a poor substitute for the evidence inside an individual incident. A campaign aimed at a specific firm may impersonate its payroll provider or a local supplier instead of the most common global brand. Conversely, Microsoft’s high reported share does not show that the vendor’s own controls are less secure than those of organisations with lower impersonation shares.
Cyber Insider has recently covered separate Check Point research on concealed phishing infrastructure. That investigation dealt with the way malicious domains hide content from unsolicited visitors. The new quarterly report concerns which identities and services are imitated and includes examples of emerging tool-specific lures. These are different datasets and editorial questions.
The report’s own comparisons show that rankings are sensitive to how categories are defined. Technology, social networks, and banking are industries represented in the research, whereas Microsoft, Apple, and Google are brands. A high share for a brand does not mean an equivalent share for an industry, and a change in rank can occur if other brands decline even without growth in absolute volume. The source does not publish a universal denominator against which these figures could be converted into the total number of malicious messages worldwide.
The findings document business identity and developer software used as attack pretexts, but cannot establish a market-wide change without comparable visibility into phishing beyond Check Point’s dataset. The 33% figure remains a measured share within Check Point’s research, while the number of compromised organisations and the effectiveness of specific phishing campaigns are not established by the ranking.
