Check Point Research (CPR), the Threat Intelligence arm of Check Point Software Technologies Ltd., a pioneer and global leader of cyber security solutions, today released its Brand Phishing Ranking for Q2 2026. These latest findings reveal that Microsoft continues to remain the most impersonated brand, accounting for 23% of all brand phishing attempts during the quarter — nearly double the next closest brand. The findings show that cybercriminals continue to exploit the trust users place in widely used technology, social networking, banking and now AI platforms to steal credentials, payment details and personal information.
In Q2 2026, LinkedIn ranked second at 11.6%, followed by Google at 6.7%, Apple at 5.8% and Amazon at 5.2%. Together, the top five impersonated brands accounted for more than half of all brand phishing activity tracked this quarter, underscoring how attackers are focusing on a small group of globally recognised platforms that people use and trust every day.
A notable shift this quarter was the first appearance of Open AI’s ChatGPT among the top ten most impersonated brands, marking a clear signal that AI tools are now firmly on cybercriminals’ radar. As AI platforms become part of daily workflows for subscriptions, payments and workplace tasks, they are becoming attractive targets for phishing campaigns in the same way as established technology and financial brands.
By industry, Technology remained the most impersonated sector, followed by Social Networks and Banking, reflecting attackers’ continued focus on platforms that hold users’ identities, professional relationships and money.
Omer Dembinsky, Data Research Manager at Check Point Research said, “Brand phishing is entering a new phase where attackers are not only exploiting trust in household technology names, but also moving quickly toward the AI platforms people are beginning to rely on every day. As generative AI enables criminals to create more credible emails, cloned websites and fake digital experiences at scale, organisations must shift from reacting after compromise to preventing these threats before users ever engage with them.”
Top 10 Most Imitated Brands in Phishing – Q2 2026
- Microsoft – 22.6%
- LinkedIn – 11.6%
- Google – 6.7%
- Apple – 5.8%
- Amazon – 5.2%
- Adobe – 3.8%
- Facebook – 1.9%
- WhatsApp – 1.4%
- PayPal – 1.3%
- ChatGPT – 1.1%
Real-World Phishing Campaigns Observed in Q2 2026
The Q2 2026 report highlights a wide range of brand phishing techniques, from fake payment failure notices to replica online stores, fraudulent login pages and malware disguised as software updates.
One campaign impersonated ChatGPT Plus through a fake subscription payment failure email that led victims to a page designed to steal full credit card details. Another campaign used a lookalike Michael Kors online store that replicated the shopping journey, including browsing, cart and checkout, to capture payment information under the appearance of a legitimate purchase.
Attackers also created a fake UNIQLO regional storefront in a market where the brand does not officially operate, with disconnected social media icons serving as one of the indicators of fraud. In another case, a fake Apple iCloud login page used Apple’s logo and branding, while a non-functional sign-in button suggested the page may still have been under testing before a broader campaign.
The report also documented a near-identical PayPal login page with a distorted logo, which may indicate the use of AI-generated assets, and a fake Microsoft support page that pushed an urgent Office security update but delivered a disguised executable file instead.
Why Brand Phishing Is Becoming Harder to Spot
Brand phishing works because it transfers trust from a familiar organisation to a fraudulent message or website. Across Q2 2026 cases, attackers used urgency, realistic branding, lookalike domains, broken buttons, mismatched links and subtle visual flaws to lower user suspicion and drive faster action.
Generative AI is also changing the economics of brand phishing by helping attackers produce more convincing emails and fraudulent websites at scale, making both the volume and sophistication of these attacks likely to grow. With generative AI lowering the barrier to creating convincing fake websites, emails and digital experiences, brand phishing is becoming harder to detect and easier to scale. As trust becomes the primary target, organisations must assume these attacks will continue to grow in both volume and sophistication.
Follow Check Point on LinkedIn, X (formerly Twitter), Facebook, YouTube and our blog.
