In the third quarter of 2026, Microsoft was impersonated in 33% of all brand phishing attempts tracked by Check Point Research, up sharply from 23% in the previous quarter and roughly four times the share of any other brand. The finding comes from the Q3 2026 Brand Phishing Report published by Check Point in late October 2026, and it confirms a trend every email administrator should understand: when attackers pick a mask, they increasingly pick the one that opens the corporate front door.
A top five that covers more than half of all attempts
The Q3 2026 ranking puts Microsoft far ahead of everyone else. Apple moved up two places into second with 8%, tied with Google in third, while LinkedIn dropped two places to fourth with 6% and Amazon completed the top five. Together, these five brands accounted for more than half of all brand impersonation attempts observed during the quarter, which shows how heavily attackers lean on a small group of trusted names.
The biggest climbers were Dropbox, which jumped ten places into eighth, and YouTube, which rose five places into sixth, both entering the top ten. By industry, Technology remained the most impersonated sector, followed by Social Networks and Banking, the places where people keep their most valuable accounts.
Why Microsoft leads by a mile
Check Point’s explanation is simple. Stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, while most other top brands mainly lead to personal accounts. A single Microsoft 365 credential can be the difference between a nuisance and a full breach, so attackers invest their effort where the payout is.
Attackers now impersonate AI and developer tools
Two examples from the report stand out because they point at where brand phishing is heading. A phishing email sent in October 2026 impersonates Claude, Anthropic’s AI assistant, claiming that a EUR 500.00 payment for the billing period was declined and that API access and Claude seats will be paused unless a payment method is updated. The message came from the unauthorized address billing-update@account-notif[.]com and used Claude and Anthropic branding to steer victims into a fraudulent payment update flow.
The second example targets developers. The website antigravity-ide-google[.]com, registered in September 2026, impersonates Google Antigravity, Google’s agentic software development platform. It shows visitors a Linux installation command that looks legitimate but actually decodes and runs a Base64 encoded command, which downloads and executes a shell script from an external server and gives the attacker remote code execution on the victim’s machine.
The terminal and RMM tricks
Attackers are also moving beyond stealing passwords. A fake Apple support site, apple-support[.]today, registered in September 2026, closely imitates the official Apple website and publishes an article titled “Boost your Mac using the terminal”, persuading visitors to run malicious commands on their own systems. A set of websites impersonating Docusign, first registered in September 2026 and continuing into early October, show a document waiting for signature behind an “Update Required” prompt claiming a Docusign Reader update is needed. Clicking Continue downloads a FleetDeck remote monitoring and management installer, a legitimate RMM product abused to gain unauthorized remote access to the victim’s device.
What this means for DMARC and your domain
Brand phishing lives on two distinct attack surfaces, and they need different defenses. The first is the spoofed email itself, a message that falsely claims to come from microsoft.com or your own domain. That surface is what DMARC exists for. If your domain publishes an enforcing policy, receivers quarantine or reject forged mail, and the exact domain spoofing branch of brand phishing collapses at the DNS layer.
The second surface is the lookalike domain and the fake website, such as apple-support[.]today or antigravity-ide-google[.]com. No email authentication standard can stop those, because the attacker genuinely owns the domain they send from. What you can do is monitor for lookalike registrations of your brand, train users that a convincing page says nothing about the address bar, and watch for unapproved remote management tools appearing on endpoints.
The uncomfortable reading of the Q3 2026 numbers is that trust is the product attackers are stealing. Microsoft holds the top spot precisely because employees trust its sign in pages without question. If your own brand has name recognition, the same logic applies to your domain, and a DMARC policy left at p=none is an open invitation to anyone who wants to borrow that trust.
Brand phishing attacks your customers and your colleagues in the name of brands they trust, and your own domain is part of that battlefield. Excello Mail shows you exactly what is being sent as your domain, so you can move from monitoring to enforcement with confidence. Sign up for free to Excello Mail and take control of your domain’s identity.