Check Point Research said Microsoft was the most imitated brand in phishing in the third quarter of 2026. Microsoft drew 33% of the brand impersonation attempts the firm tracked, up from 23% in the second quarter. Help Net Security reported that Apple and Google tied behind it at 8% each, about a quarter of Microsoft's share. Check Point also showed fake pages posing as Claude, Google Antigravity, Apple support and Docusign.
Some lures make the victim do the work. The Antigravity page shows a Linux command that looks like an installer but hides an encoded instruction. Running it fetches a script from another server and runs it, giving the attacker control of the machine. The Apple page offers a Mac speed tip built on terminal commands. The Docusign pages push FleetDeck, a real remote management tool, which Check Point reads as a bid for remote access. The sources give no attack totals, victim counts or site owners. The Claude billing email went out in October, after the quarter ended.
Check Point says a stolen Microsoft login can open email, files and team tools. These lures skip the password and get the user to install the access. That gives install controls the same weight as email filtering. Leaders could ask who may install remote tools, and how unapproved ones get spotted.