Microsoft Top Brand in Q3 Phishing Report

Executive Summary

Microsoft has been identified as the most frequently impersonated brand in phishing attacks for the third quarter of 2026, according to a new report from Check Point Research. The tech giant accounted for 33% of all brand phishing attempts, a sharp increase from 23% in Q2 2026. Attackers favor Microsoft due to the high value of its credentials, which can unlock access to entire corporate ecosystems. The report also notes an emerging trend: the impersonation of AI and developer platforms. Campaigns were observed mimicking Anthropic's Claude AI and a Google developer platform to harvest credentials and execute malicious code, signaling an expansion of phishing targets.

Threat Overview

Brand phishing is a type of social engineering attack where a threat actor impersonates the official website or communications of a well-known brand. The goal is to trick victims into providing sensitive information, such as login credentials or payment details, or to deploy malware.

In Q3 2026, the top impersonated brands were:

1. Microsoft (33%)
2. Apple (8%)
3. Google (8%)

Microsoft's dominance is driven by the widespread enterprise adoption of Microsoft 365. A single compromised account can give an attacker access to Outlook emails, SharePoint files, Teams chats, and a foothold for further lateral movement within a corporate network.

Technical Analysis

The report highlights two notable new campaigns, demonstrating the evolution of phishing tactics:

1. Anthropic/Claude Impersonation: Attackers sent fake "payment failed" emails to users of the Claude AI assistant. The emails, designed to look like official communications from Anthropic, led victims to a phishing page where they were prompted to enter their credentials and payment information. This is a classic phishing attack (T1566.002) aimed at financial theft and credential harvesting.

2. Google Antigravity Impersonation: This campaign targeted developers. Phishing emails tricked users into running a malicious script disguised as a tool for Google's (fictional) 'Antigravity' platform. Executing the script resulted in remote code execution (T1204.002) on the victim's machine, giving the attacker a powerful backdoor. This shows attackers are targeting the software development lifecycle itself.

Impact Assessment

The impact of brand phishing is significant. For individuals, it can lead to financial loss and identity theft. For organizations, a successful phishing attack against an employee using a Microsoft 365 account can be the initial access vector for a major data breach or ransomware attack. The cost of remediation, data loss, and reputational damage can be enormous. The new trend of targeting developers and AI users is particularly concerning, as compromising these accounts can lead to supply chain attacks or the theft of valuable intellectual property and proprietary code.

IOCs — Directly from Articles

No specific IOCs such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for phishing attempts by looking for:

• Lookalike Domains: Use tools to monitor for newly registered domains that are visually similar to your brand or key partners (e.g., micros0ft-login.com).
• Email Header Anomalies: Analyze email headers for signs of spoofing, such as mismatches in the From: and Return-Path: fields, or failures in SPF/DKIM/DMARC checks.
• Suspicious URL Patterns: Search web proxy logs for users visiting URLs with patterns common in phishing, such as long, complex subdomains or the use of URL shorteners for links that should be direct.

Detection & Response

1. Email Security Gateways: Use advanced email security solutions that can detect phishing attempts through URL scanning, attachment sandboxing, and impersonation detection.
2. Browser Security: Deploy browser isolation or security extensions that can warn users before they visit a known or suspected phishing site.
3. User Reporting: Implement a simple, one-click button for users to report suspected phishing emails. This turns employees into a valuable part of the detection process. This is a form of User Training (M1017).

Mitigation

1. Multi-Factor Authentication (MFA): Enforce MFA across all services, especially for critical applications like Microsoft 365. While not foolproof, it is the single most effective control against credential theft. This is a direct implementation of Multi-factor Authentication (D3-MFA).
2. Security Awareness Training: Continuously train and test employees on how to recognize and respond to phishing attacks. Training should be updated to include new trends like AI platform impersonation.
3. DMARC, DKIM, and SPF: Implement and enforce DMARC (Domain-based Message Authentication, Reporting, and Conformance) to prevent attackers from spoofing your organization's domain in emails.
4. Zero Trust Principles: Adopt a Zero Trust architecture where access to resources is granted on a per-session basis and continuously verified, reducing the value of a single stolen credential.