Microsoft accounts for 33 pc of brand phishing attacks in Q3, Apple, Google trail: Report

New Delhi: Phishing that impersonates well‑known brands entered a new phase in the third quarter, with Microsoft accounting for 33 per cent of all brand phishing attempts tracked, up from 23 per cent in Q2, a report said on Monday.

The report from Check Point Research said the top five brands — Microsoft, Apple, Google, LinkedIn and Amazon — together accounted for over half of all brand impersonation attempts.

Apple rose two places to second accounting for 8 per cent of attempts, while Google tied at 8 per cent, LinkedIn at 6 per cent and Amazon at 4 per cent. Microsoft’s 33 per cent share was roughly four times that of any other brand.

Attackers impersonated AI and developer platforms such as Claude and Google Antigravity, using fake billing alerts and malicious installation commands, the report noted.

Other campaigns moved beyond credential theft by persuading victims to run terminal commands or install legitimate remote access software themselves.

The evolution was also visible at industry level with technology remaining the most impersonated sector, followed by Social Networks and Banking.

These were areas where people keep some of their most valuable accounts, from work email and cloud storage to social profiles and financial information, the report noted.

“Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves,” said Omer Dembinsky, Data Research Manager at Check Point Research.

Dembinsky noted that generative AI made convincing emails and cloned websites easier to produce at scale, necessitating organisations to enforce prevention that reaches both the inbox and the wider web.

The report cited a campaign that impersonated Claude through a fake payment failure email claiming that a €500.00 charge had been declined. The message warned that API access and Claude seats would be paused unless the recipient updated their payment method, placing both financial details and account credentials at risk.

Attackers also created a fake Apple support article that encouraged Mac users to run terminal commands under the promise of improved performance

“Organisations should stop phishing messages before they reach inboxes, use AI-powered detection for brand impersonation and credential harvesting, automate investigation and response,” the report urged.

It also suggested firms to monitor for unapproved remote management tools, and scan the wider web for lookalike domains and cloned login pages so fraudulent sites can be removed before customers engage with them.

ABOUT THE AUTHOR

IANS

[email protected]