Microsoft accounted for 33 per cent of all brand phishing attempts tracked globally in the third quarter of 2024, up sharply from 23 per cent in Q2, according to a new report by Check Point Research. The jump makes Microsoft the single most impersonated brand by a wide margin — roughly four times the share of any other name on the list.

Top Brands Targeted

The top five impersonated brands — Microsoft, Apple, Google, LinkedIn, and Amazon — together accounted for over half of all brand impersonation attempts recorded in the quarter. Apple rose two places to second position, tying with Google at 8 per cent each. LinkedIn followed at 6 per cent and Amazon at 4 per cent.

At the industry level, technology remained the most impersonated sector, followed by social networks and banking — precisely the areas where individuals hold their most sensitive accounts, from work email and cloud storage to financial credentials.

Attackers Move Into AI and Developer Platforms

Notably, attackers have begun extending their reach into AI and developer tools, with campaigns impersonating platforms such as Claude and Google Antigravity. One campaign highlighted in the report spoofed Claude through a fake payment failure email, warning recipients that a €500.00 charge had been declined and that API access and Claude seats would be suspended unless payment details were updated — placing both financial information and account credentials at risk.

A separate campaign created a fraudulent Apple support article that encouraged Mac users to run terminal commands under the false promise of improved device performance. This marks a qualitative shift: rather than simply harvesting passwords through fake login pages, attackers are now persuading victims to execute malicious commands or install legitimate remote access software themselves.

What Experts Said

Omer Dembinsky, Data Research Manager at Check Point Research, said: 'Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves.'

Dembinsky further noted that generative AI has made it significantly easier to produce convincing phishing emails and cloned websites at scale, making it essential for organisations to enforce preventive measures that extend beyond the inbox to the wider web.

Recommendations for Organisations

The report urged companies to stop phishing messages before they reach inboxes, deploy AI-powered detection tools capable of identifying brand impersonation and credential harvesting attempts, and automate investigation and response workflows. It also recommended monitoring for unapproved remote management tools and scanning the broader web for lookalike domains and cloned login pages, so that fraudulent sites can be identified and removed before users interact with them.

This comes amid a broader trend of increasingly sophisticated social engineering attacks that exploit familiarity with everyday platforms. With generative AI lowering the barrier for attackers to produce polished, convincing lures at scale, cybersecurity experts warn that both consumers and enterprises will need to raise their defences well into 2025.