Microsoft Is Now the Disguise in One of Every Three Brand Phishing Attempts: Six Rings of Defense, From the Open Web to the Help Desk
Check Point Research says Microsoft was the brand behind 33% of the impersonation phishing it tracked last quarter, up from 23%, and that lures are shifting from stealing passwords to getting victims to run commands or install remote access tools themselves. Here is how to build defenses in rings around your people.
Here Is How Layered Defenses Help When a Trusted Brand Is the Disguise
Phishers dress their messages up as the companies people trust most, and for business users that increasingly means Microsoft. The reason is simple economics: one stolen Microsoft login can open a company’s email, shared files and chat all at once, while many other brands only lead to a personal account.
That is the headline finding of Check Point Research’s brand phishing report for the third quarter of 2026, which Help Net Security also covered on Monday.
The numbers in brief
- Microsoft accounted for 33% of the brand impersonation attempts Check Point tracked from July to September, up from 23% the quarter before and about four times any other brand.
- Apple rose two places to second with 8%, tied with Google; LinkedIn slipped to fourth with 6%; Amazon rounded out the top five. Together the top five made up more than half of all attempts.
- Dropbox jumped ten places to eighth and YouTube climbed five places to sixth.
- Technology brands were impersonated most, followed by social networks and banking.
The lure gallery
Check Point’s examples show a shift worth noticing: several of these lures do not ask for a password at all. They ask the victim to do the attacker’s work.
- A fake AI bill. An October email dressed as Anthropic’s Claude claimed a €500 payment had failed and that API access and seats would be paused, pushing the reader to an “Update payment method” button that leads into a fake process putting both card details and account credentials at risk.
- A poisoned install command. A lookalike site for Google Antigravity, Google’s agentic development platform, showed a Linux install command that quietly decoded a hidden instruction and downloaded and ran a script from an attacker’s server.
- A fake support article. A site closely imitating Apple’s support pages carried an article promising to “boost your Mac” by running commands in the terminal.
- A fake reader update. Docusign lookalike sites showed a document waiting to be signed and an “Update Required” prompt. Clicking through downloaded an installer for FleetDeck, a legitimate remote monitoring and management tool, which Check Point says points to an attempt to gain unauthorized remote access to the victim’s computer.
Six rings of defense, from the outside in
Ring 1: The open web
Most fake sites start as copies of real ones. Watch for newly registered domains that imitate your own brand or the services you rely on, and have a way to get them taken down. Publishing DMARC, SPF and DKIM records for your own domain makes it harder for anyone to send email that appears to come from you.
Ring 2: The inbox
Filter mail before it reaches people. Link checking at the moment of the click, attachment sandboxing and impersonation detection catch many of these lures, including ones that pretend to be billing alerts.
Ring 3: The person
Teach three simple rules: real software updates come from the app itself, not from a web page; never paste a command you found on a website or in an email into a terminal or Run box; and when a bill looks wrong, go to the vendor’s site by typing the address, not by clicking.
Ring 4: The device
Make it hard for a tricked user to cause damage. Everyday accounts should not have administrator rights, scripting tools can be restricted for staff who do not need them, and application control can block remote access tools your IT team has not approved.
Ring 5: The identity
Assume some passwords will be stolen. Phishing-resistant sign-in such as passkeys or hardware security keys will not work on a lookalike site, and conditional access rules can require a known, managed device before anyone reaches company email and files.
Ring 6: Detection and the help desk
Alert when new remote management software appears on a computer, when sign-ins come from unfamiliar places, and when mailbox forwarding rules change. Make sure your help desk verifies anyone asking for a password reset or new MFA device through a second channel.
Tools are examples, not the answer
Microsoft’s own stack covers several rings, for instance Defender for Office 365 for the inbox, Intune and application control policies for devices, and Entra ID conditional access for identity. Third-party email security, DNS filtering, brand monitoring and endpoint detection products can fill the same roles. No single product covers all six rings, and the protection comes from stacking them so that a lure that slips past one meets the next.
What this means for your company
If your business runs on Microsoft 365, you are using the brand attackers imitate most, so your staff will see these lures. Start with the rings that cost the least: turn on the email protections you already pay for, remove local administrator rights from everyday accounts, and spend ten minutes at your next team meeting on the “never paste a command, never install an update from a web page” rule. Then ask whoever manages your IT which remote access tools are approved and whether anything else would trigger an alert.
Need help building layered protection against brand-impersonation phishing across email, devices and Microsoft 365? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
