Microsoft becomes phishers’ favourite target

New Delhi: Phishing that impersonates well known brands entered a new phase in the third quarter, with Microsoft accounting for 33 per cent of all brand phishing attempts tracked, up from 23 per cent in Q2, a report said on Monday.

The report from Check Point Research said the top five brands — Microsoft, Apple, Google, LinkedIn and Amazon — together accounted for over half of all brand impersonation attempts.

Apple rose two places to second accounting for 8 per cent of attempts, while Google tied at 8 per cent, LinkedIn at 6 per cent and Amazon at 4 per cent. Microsoft’s 33 per cent share was roughly four times that of any other brand.

Attackers impersonated AI and developer platforms such as Claude and Google Antigravity, using fake billing alerts and malicious installation commands, the report noted.

Other campaigns moved beyond credential theft by persuading victims to run terminal commands or install legitimate remote access software themselves.

The evolution was also visible at industry level with technology remaining the most impersonated sector, followed by Social Networks and Banking. These were areas where people keep some of their most valuable accounts, from work email and cloud storage to social profiles and financial information, the report noted.

“Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves,” said Omer Dembinsky, Data Research Manager at Check Point Research. Dembinsky noted that generative AI made convincing emails and cloned websites easier to produce at scale, necessitating organisations to enforce prevention that reaches both the inbox and the wider web.

The report cited a campaign that impersonated Claude through a fake payment failure email claiming that a €500.00 charge had been declined. The message warned that API access and Claude seats would be paused unless the recipient updated their payment method, placing both financial details and account credentials at risk.

ABOUT THE AUTHOR

The Hans India