Microsoft's name appeared in 33% of all brand phishing attempts in the third quarter of 2026, according to Check Point figures reported by Techcoffeehouse.com. That share, up from 23% the previous quarter, put Microsoft far ahead of every rival and made its name the likeliest fake in the inbox for anyone who signs into a Microsoft account daily.

The ranking measures where scammers aimed this quarter, not how safe any brand's users are. A brand that slips can still generate a flood of fraud: a small share of a very large number of attempts adds up to many messages.

What does the shift toward Microsoft change?

Scammers made the move within three months. For practitioners, the practical consequence is simple: the most routine-looking Microsoft notice — a sign-in request, a verification prompt, an approval demand — is now the one most likely forged. The safer habit is to close the message and open the account directly through a known address.

Apple climbed two places to second. Its name appeared in 8% of attempts — a single-digit share, but enough to rank second, which means no brand except Microsoft drew a large share at all. Modest shifts in attacker behavior can move Apple up or down the list regardless of what its users do. An Apple-branded sign-in warning now deserves the same suspicion as one from Microsoft.

Google tied Apple at 8%, taking third place. Criminals bet on the account people check every day. Most forgeries rely on lookalike sites, but not all — and that changes the standard advice.

Why does checking the sender no longer protect anyone?

In one campaign, attackers sent emails through the Send Email feature of Google Cloud Application Integration without breaching Google's infrastructure, Security Affairs reports. The redirect even passed through googleusercontent.com, a real Google domain. The attackers sent nearly 9,400 emails over two weeks, and it is unclear whether campaigns abusing Google's own tools count toward its 8% share.

Google has since blocked a number of campaigns that abused the notification tool, but only after the abuse began. "While we have implemented protections to defend users against this specific attack, we encourage continued caution as malicious actors frequently attempt to spoof trusted brands," Google said in a statement.

Omer Dembinsky, Data Research Manager at Check Point Research, framed the broader shift: "Brand phishing is entering a new phase. Attackers are still exploiting trust in the technology platforms people use every day, but they are also following users into AI and developer tools and moving beyond password theft to convince victims to run malicious commands or install remote access software themselves."

A careful look at a login page protects no one once the victim has run the attacker's command. The danger now includes a familiar brand asking someone to act, not only a fake page asking for a password.

What does LinkedIn's drop hide?

LinkedIn fell two places but still ranked fourth, with its name in 6% of attempts. Australians filed 138 reports of LinkedIn scams with their national consumer watchdog in July and August alone, ABC News reports. In a LinkedIn survey of Australians, nearly half of respondents said they were willing to take chances in their job applications, and about 16% said a job scam had already caught them.

"This is a scam designed to exploit jobseekers," tech recruiter Trevor Churchley said. Fraudsters used the brand of engineering firm Aurecon alongside a cloned profile of a real Aurecon employee. A respected name and a real-looking profile prove nothing; treat any unsolicited offer as unconfirmed until the employer verifies it through its own channels.

Why does Amazon's 4% still matter?

Amazon ranked fifth at 4% of attempts. Phishing volume tracks spending: scammers send more fake Amazon messages during heavy-spending sales events, Better Business Bureau findings reported by the Associated Press in 2024 show. Amazon held Prime Day on July 16–17, 2024 — inside the third quarter — so sale timing can inflate or deflate a quarter's count. Ahead of that sale, Check Point found more than 1,230 sites linked to Amazon had gone up in June alone, most judged malicious or suspicious.

The scripts stay stable. Claims of trouble with an order or an account made up more than two-thirds of the scams Amazon customers reported in 2023, per Amazon figures cited by the AP. "Typically, the bones remain the same," said Josh Planos, vice president of communications and public relations at the Better Business Bureau. Consumers reported impostor scams more than any other fraud type in 2023, ahead of online shopping scams, per FTC figures. Expect more fake order warnings whenever a big sale approaches.