Microsoft faces 33% share of brand phishing attempts in Q3 2026

Organisations relying on Microsoft services face heightened risk as cybercriminals increasingly target corporate credentials. According to Check Point Research, Microsoft accounted for 33% of brand impersonation attempts in the third quarter of 2026. This represents a rise from the previous quarter’s 23% share. The figure is roughly four times the share of any other brand tracked during the same period.

Why are attackers focusing on Microsoft accounts?

The research team explained that attackers favour Microsoft because stolen credentials can unlock an entire corporate environment. This access extends to email, files and collaboration tools. In contrast, many other top impersonated brands mainly lead to personal accounts. Technology brands were impersonated most often overall, followed by social networks and banking sectors.

Which other brands are seeing increased impersonation?

Apple and Google followed Microsoft in the rankings, with each accounting for 8% of attempts. Dropbox and YouTube recorded the biggest climbs in the rankings during the quarter. These figures highlight a shift in attacker strategy towards high-value enterprise targets. The data suggests that while consumer brands remain relevant, the primary focus for significant operational gain lies with enterprise software providers.

What new phishing tactics are emerging?

A phishing email sent in October 2026 used Claude and Anthropic branding to claim a €500 payment had been declined. This example occurred after the July–September reporting period. The message warned that API access would be paused unless payment methods were updated. Another campaign involved a website impersonating Google Antigravity, displaying a Linux command that downloaded and executed malicious scripts. Additionally, fake Docusign sites prompted users to install a FleetDeck installer, enabling remote device access.

How do these attacks compromise user devices?

The fake Docusign websites displayed documents awaiting review, claiming an update was required to open them. Clicking the prompt downloaded FleetDeck, a remote monitoring product that can be abused to access devices. Similarly, the Google Antigravity impersonation site displayed a command that decoded and ran concealed instructions. These methods allow attackers to run code on victim computers directly, bypassing traditional email-based credential theft.

What affected people can do

Teams usually advise users to verify the source of any unexpected payment failure notifications or software update requests. Check whether the sender’s email address matches the official domain of the service provider. Avoid clicking links in emails that create a sense of urgency, such as warnings about paused access or declined payments. Instead, navigate directly to the service’s official website to check account status. Be cautious of any instructions to run terminal commands or install software from unverified sources, as these are common indicators of malicious activity.

What to do and how to stay safe: Microsoft

• Verify the legitimacy of any email claiming payment failures or account suspensions by contacting the vendor through official channels.
• Inspect the URL of any login or payment page before entering credentials, ensuring it matches the official domain exactly.
• Avoid running terminal commands or installing software prompted by unsolicited emails or suspicious websites.
• Enable multi-factor authentication on all corporate accounts to add an additional layer of security against credential theft.

Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What percentage of phishing attempts targeted Microsoft in Q3 2026?

Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026.

Why do attackers prefer Microsoft credentials over other brands?

Stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, whereas other brands often lead only to personal accounts.

What new phishing campaigns were reported in late 2026?

Campaigns impersonating Claude, Google Antigravity and Docusign were reported, aiming to steal payment details or install remote access tools like FleetDeck.