Phishing attacks use the Microsoft brand in 33% of monitored attempts

Check Point Research monitored phishing attacks that copy a brand, from July to September 2026. Microsoft had 33% of the attempts, and 23% in the 3 months before. This is about 4 times more than each other brand. Apple and Google had 8% each. Technology brands are the primary group, then social networks and banks.

What is new

Scammers also copy AI and developer tools. Check Point gives these examples:

• In October 2026, an email used the Claude name to tell the user of a problem with a €500 payment.
• A site that copies Google Antigravity shows a Linux command that gets a script from an external server.
• A site that copies Docusign gives a FleetDeck installer, a remote access tool.

The numbers

The data is for July to September. The Claude email came after that period. The source has no data on the damage to victims.

What is not known

Check Point tells that the Docusign site shows a try to get access to the computer of the victim. The cause of each attack is not shown. The source does not tell how many persons used the commands.

Insight: Attackers copy AI tools to make the user do the attack

A page that copies Claude in a Google ad, found on 9 October, showed one install command but put a different command in the clipboard. An Apple site that was a copy told users to put commands in a terminal. This reads as a selection of AI tools by attackers, because their users frequently put commands in a terminal. Then the user does the attack. Each install command is a risk.