If a suspicious email or login page lands in front of you this month, the odds are it is pretending to be Microsoft. In its Q3 2026 Brand Phishing Ranking, Check Point Research found that Microsoft was impersonated in 33% of all brand phishing attempts it tracked during the quarter, up from 23% in the previous quarter and roughly four times the share of any other brand.
Contents
Quick facts
- Microsoft was faked in 33% of brand phishing attempts in Q3 2026, up from 23% in Q2
- Apple and Google tied next at 8% each, then LinkedIn (6%) and Amazon (4%)
- New this quarter: fake Claude billing emails and a lookalike Google Antigravity install page
- The defence: open the service yourself, never run a command an email asks you to
Brand phishing works by copying a trusted name, its logo, its wording and a near-identical web address, so a fake message or page looks like the real thing. Microsoft is a favourite because one stolen Microsoft password can open a person's work email, files and workplace tools in one go, where most other brands lead only to a single personal account.
Five brands behind more than half of all attempts
The top of the ranking stayed crowded with familiar names:
- Microsoft: 33% of attempts, up from 23%
- Apple: 8%, up two places to second
- Google: 8%, third
- LinkedIn: 6%, fourth
- Amazon: 4%, fifth
Together those five names accounted for more than half of every brand impersonation attempt Check Point Research logged in the quarter. By sector, technology was the most impersonated, followed by social networks and then banking, the three areas where people keep their most valuable accounts.
Attackers are now following users into AI tools
The more telling change this quarter was in method. Check Point Research recorded campaigns that impersonated AI and developer platforms, including Claude and Google Antigravity, using fake billing alerts and malicious installation steps. One fake email claimed a 500 euro charge on a Claude account had been declined and warned that access would be paused unless payment details were updated, putting both card details and the account login at risk.
Another used a lookalike Google Antigravity website that showed what looked like an ordinary Linux installation command. Running it quietly decoded and executed a script from an outside server, handing the attacker remote control of the machine. In separate cases, a fake Apple support article urged Mac users to run terminal commands for better performance, and a spoofed Docusign page downloaded FleetDeck, a legitimate remote access tool, under the guise of a required update. It is part of a wider shift we have been tracking, where attackers move beyond stealing passwords to taking direct control of a device, and increasingly use AI to do it at scale.
What it means for Malaysians
Microsoft 365, Apple IDs, Google accounts, LinkedIn and Amazon are all part of daily life here, and AI tools like Claude are now common in Malaysian studios, offices and classrooms, so none of this is a distant enterprise problem. We have seen the same playbook aimed at ordinary users before, such as the scam that posed as Signal support to steal message backups.
Further down the top ten, YouTube climbed five places to 3% and Dropbox jumped ten places to 2%, while WhatsApp, which most Malaysians open every day, slipped one place to 1%.
"Brand phishing is entering a new phase," said Omer Dembinsky, Data Research Manager at Check Point Research, pointing to attackers following users into AI tools and convincing them to run harmful commands themselves.
The simple defence still holds
The practical advice has not changed much, but it matters more than ever. Treat any urgent message about billing, a declined payment or a locked account with suspicion, open the service yourself rather than clicking a link, and never run a command or install software just because an email or a web page tells you to. Check Point Research publishes these rankings every quarter, and its recent reports point the same way: the brands we trust most are the ones criminals borrow first.
