By 
Check Point Research: Microsoft Leads Q2 2026 Brand Phishing as ChatGPT Emerges as a New Phishing Target
In its Q2 2026 Brand Phishing Ranking, Check Point Research reports that Microsoft remains the most impersonated brand worldwide, representing 23% of all phishing attempts tracked during the quarter.
RELATED: Major Cloudflare outage disrupts ChatGPT, X (Twitter), ITEdgeNews and major websites
That figure is almost double the share of the second-ranked brand, reinforcing a trend: attackers consistently exploit the trust, ubiquity, and daily reliance users place in Microsoft products to breach defenses.
Cybercriminals continue to exploit digital trust
The findings also show that cybercriminals continue to exploit the trust users place in widely-used technology, social networking, banking and now AI platforms to steal credentials, payment details and personal information.
In Q2 2026, LinkedIn ranked second at 11.6%, followed by Google at 6.7%, Apple at 5.8% and Amazon at 5.2%. Together, the top five most impersonated brands accounted for more than half of all brand phishing activity tracked this quarter, underscoring how attackers are focusing on a small group of globally recognised platforms that people use and trust every day.
Open AI’s ChatGPT joins the top 10 list
Notably, Open AI’s ChatGPT made the top 10 list for the first time, marking a clear signal that AI tools are now firmly on cybercriminals’ radar. As AI platforms become part of daily workflows for subscriptions, payments and workplace tasks, they are becoming attractive targets for phishing campaigns in the same way as established technology and financial brands.
By industry, Technology remained the most impersonated sector, followed by Social Networks and Banking, reflecting attackers’ continued focus on platforms that hold users’ identities, professional relationships and money.
Omer Dembinsky, Data Research Manager at Check Point Research said, “Brand phishing is entering a new phase where attackers are not only exploiting trust in household technology names, but also moving quickly toward the AI platforms people are beginning to rely on every day. As generative AI enables criminals to create more credible emails, cloned websites and fake digital experiences at scale, organisations must shift from reacting after compromise to preventing these threats before users ever engage with them.”
Top 10 Most Imitated Brands in Phishing – Q2 2026
- Microsoft – 22.6%
- LinkedIn – 11.6%
- Google – 6.7%
- Apple – 5.8%
- Amazon – 5.2%
- Adobe – 3.8%
- Facebook – 1.9%
- WhatsApp – 1.4%
- PayPal – 1.3%
- ChatGPT – 1.1%
Real-World Phishing Campaigns Observed in Q2 2026
The Q2 2026 report highlights a wide range of brand phishing techniques, from fake payment failure notices to replica online stores, fraudulent login pages and malware disguised as software updates.
One campaign impersonated ChatGPT Plus through a fake subscription payment failure email that led victims to a page designed to steal full credit card details. Another campaign used a lookalike Michael Kors online store that replicated the shopping journey, including browsing, cart and checkout, to capture payment information under the appearance of a legitimate purchase.
Attackers creating pseudo-brand identities
Attackers also created a fake UNIQLO regional storefront in a market where the brand does not officially operate, with disconnected social media icons serving as one of the indicators of fraud. In another case, a fake Apple iCloud login page used Apple’s logo and branding, while a non-functional sign-in button suggested the page may still have been under testing before a broader campaign.
The report also documented a near-identical PayPal login page with a distorted logo, which may indicate the use of AI-generated assets, and a fake Microsoft support page that pushed an urgent Office security update but delivered a disguised executable file instead.
Why Brand Phishing Is Becoming Harder to Spot
Brand phishing works because it transfers trust from a familiar organisation to a fraudulent message or website. Across Q2 2026 cases, attackers used urgency, realistic branding, lookalike domains, broken buttons, mismatched links and subtle visual flaws to lower user suspicion and drive faster action.
Generative AI is also changing the economics of brand phishing by helping attackers produce more convincing emails and fraudulent websites at scale, making both the volume and sophistication of these attacks likely to grow.
With generative AI lowering the barrier to creating convincing fake websites, emails and digital experiences, brand phishing is becoming harder to detect and easier to scale. As trust becomes the primary target, organisations must assume these attacks will continue to grow in both volume and sophistication.
