Microsoft accounted for 33 percent of all brand phishing attacks detected globally during the third quarter of 2026, marking a significant rise from 23 percent in the previous quarter, according to a report by Check Point Research. Cybercriminals have intensified their focus on established technology providers, with Microsoft, Apple, Google, LinkedIn, and Amazon collectively representing over half of all brand impersonation attempts. Microsoft was targeted nearly four times as often as any other corporate entity, as fraudsters expanded their methods beyond credential harvesting to deploy fraudulent payment notifications, counterfeit software tools, and deceptive terminal commands designed to compromise endpoints directly.
Emerging AI Services and Developer Platforms Targeted
Beyond established software providers, attackers are increasingly misusing the identities of artificial intelligence platforms and software development services. Fraudulent schemes have mimicked services such as Claude and Google Antigravity, circulating fake subscription notices, billing alerts, and counterfeit setup instructions. By copying the communication styles of trusted development environments, adversaries trick users into believing their payment methods have failed or their service subscriptions are facing immediate suspension.
The compromise of developer and artificial intelligence accounts presents broader operational risks for organizations. These digital assets frequently house sensitive workplace files, proprietary software code, API keys, and elevated administrative access to enterprise cloud environments. Consequently, a single compromised set of credentials can expose not only an individual user but also the broader connected infrastructure of an entire enterprise.
Deceptive Commands Replace Standard Credential Harvesting
The investigation identified specific campaigns employing novel manipulation tactics, including fraudulent notices sent to Claude users alleging a declined payment of 500 euros. The messages warned that API access would be halted unless billing details were immediately updated on a fraudulent portal. In another campaign aimed at Mac users, counterfeit Apple technical support articles instructed individuals to execute terminal commands under the guise of enhancing system performance, directly prompting victims to run unauthorized scripts on their machines.
Omer Dembinsky, data research manager at Check Point Research, noted that brand phishing has evolved past standard credential theft toward coercing users into installing remote-access software or executing hazardous local commands. The growing utilization of generative artificial intelligence has simultaneously streamlined the creation of convincing fake websites and error-free fraudulent correspondence, making manual identification increasingly difficult for enterprise employees.
Enterprise Defenses Urged Across Email and Web Channels
Technology remained the most targeted commercial sector during the third quarter, followed closely by social networking platforms and banking institutions. Security analysts emphasized that enterprise defenses must focus on intercepting malicious correspondence before it reaches employee mailboxes, recommending the implementation of automated detection tools to flag suspicious domains and cloned login portals.
Organizations were also advised to monitor networks for unapproved remote-management utilities and proactively search for lookalike domains. In addition to enterprise-level protections, individual users were urged to verify payment alerts directly through official service portals rather than third-party email links, and to refuse any technical guidance requesting the manual execution of terminal commands from unverified sources.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
