Threat reportPhishingTL-2026-1731
Check Point Q2 2026 Brand Phishing Report: Microsoft Leads at 23%, ChatGPT Enters Top 10 Impersonated Brands
Check Point Q2 2026 Brand Phishing Report (TL-2026-1731), also tracked as Q2 2026 Brand Phishing Report, is a medium-severity phishing campaign, first published 2026-07-27. It has no confirmed attribution, maps to 19 MITRE ATT&CK techniques (T1027, T1036.005, T1056.003), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1731
- Threat ID
- TL-2026-1731
- Also known as
- Q2 2026 Brand Phishing Report, Check Point Brand Phishing Trends Q2 2026
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, socialmedia, bankingfinancialservices
- Target regions
- Global, Russia/CIS (Apple iCloud lure observed in Russian language)
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Check Point Q2 2026 Brand Phishing Report
Malware and tooling: Darcula, EvilProxy, Tycoon2FA
How Check Point Q2 2026 Brand Phishing Report works
Check Point Research's Q2 2026 Brand Phishing Report found Microsoft impersonated in 23% of tracked brand-phishing attempts, with LinkedIn (11.6%), Google (6.7%), Apple (5.8%) and Amazon (5.2%) rounding out a top five that together accounts for over half of all attempts. Technology, social networks and banking were the most-impersonated sectors, and ChatGPT entered the top 10 impersonated brands for the first time as attackers pivot toward AI-tool subscription and payment lures.
Check Point Research's Q2 2026 Brand Phishing Report (published on the Check Point blog 2026-07-23, covering the April-June 2026 data-collection window) tracks which real-world brands are most frequently spoofed across phishing emails and fraudulent websites. Microsoft again topped the list at 23% of tracked attempts (up marginally from 22% in Q1 2026), with a campaign example built around a fraudulent Microsoft support page urging an 'urgent Office security update' that instead delivered a malware executable. LinkedIn moved into second place at 11.6% (nearly double its 6% Q1 2026 share), ahead of Google (6.7%), Apple (5.8%, down from 11% in Q1) and Amazon (5.2%) — the top five together covering more than half of all observed brand-phishing activity.
The headline development is ChatGPT/OpenAI entering the top 10 impersonated brands for the first time. Check Point documented a fake ChatGPT Plus subscription payment-failure billing email that mimicked OpenAI's legitimate notices and funneled victims to a credential-harvesting page engineered to capture full credit-card details. Check Point's analysts characterize this as 'a strong signal of where attacker attention is heading next,' arguing that as AI platforms become embedded in everyday subscription, payment and work-task workflows they become targets on par with legacy tech giants.
Other documented Q2 2026 campaign examples span consumer retail and identity brands: a full replica Michael Kors e-commerce site cloning browsing/cart/checkout; a counterfeit regional UNIQLO storefront with non-functional links back to the brand's real social accounts; a Russian-language fake Apple iCloud login page with a non-functional sign-in button (suggesting a still-in-testing kit build); and a near-identical PayPal login-page clone carrying a visibly distorted, likely AI-generated PayPal logo. Across campaigns, Check Point flags a consistent pattern: urgency framing (payment failures, security alerts, forced updates), subtle visual flaws (distorted logos, broken buttons, mismatched domains), and increasingly convincing AI-generated page/logo assets that erode the reliability of visual-inspection-based user training.
This report is a quarterly trend/telemetry publication rather than a single exploited vulnerability, but it sits on top of an active, industrial phishing-as-a-service (PhaaS) ecosystem that supplies the infrastructure for exactly this kind of brand-impersonation campaign at scale — kits such as Tycoon2FA, EvilProxy and Darcula auto-generate cloned, brand-accurate phishing pages and, in the AiTM (adversary-in-the-middle) cases, relay credentials and session cookies through a reverse proxy to defeat MFA in real time. Microsoft's Digital Crimes Unit and Europol disrupted Tycoon2FA's hosting infrastructure in March 2026 after it reached over 500,000 targeted organizations and 60M+ phishing messages per month at its peak; Check Point's Q2 2026 data shows the brand-impersonation problem itself unabated even after that individual kit's disruption, with attacker focus now also expanding into Microsoft Teams-based social engineering.
MITRE ATT&CK techniques used in TL-2026-1731
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Command and Control
Persistence
T1098.002 Additional Email Delegate Permissions; T1098.005 Device Registration
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1585.002 Email Accounts; T1608.001 Upload Malware; T1608.005 Link Target
Reconnaissance
Remediation for Check Point Q2 2026 Brand Phishing Report
Immediate actions
- Enforce DMARC at p=reject (with SPF/DKIM alignment) on organizational domains to block spoofed-sender mail impersonating your own brand, per CISA/NSA/FBI/MS-ISAC phishing guidance
- Deploy inline, pre-delivery phishing/BEC detection on email and collaboration platforms (including Microsoft Teams) rather than relying solely on post-delivery user reporting
- Block known AiTM/PhaaS reverse-proxy infrastructure patterns (Tycoon2FA/EvilProxy/Darcula-style kits) at the web/email gateway
- Alert users and finance/procurement teams to the specific Q2 2026 lures: 'Office security update' pages, ChatGPT Plus payment-failure emails, and brand-store checkout clones
Workarounds
- Train users to treat unsolicited 'payment failed' / 'security update required' / 'subscription issue' emails from any brand (including AI tools) as high-risk and to navigate directly to the vendor's known URL rather than clicking embedded links
- Visually inspect for the red flags Check Point calls out: distorted or low-resolution logos, non-functional buttons/links, mismatched or lookalike domains, and spelling/grammar errors
Longer-term hardening
- Adopt phishing-resistant authentication (FIDO2/WebAuthn hardware or platform passkeys) to neutralize AiTM session-cookie theft that defeats SMS/OTP/push-based MFA
- Run continuous dark-web and typosquat/lookalike-domain monitoring with takedown capability for brands most likely to be impersonated (own brand plus commonly abused SaaS brands used to phish employees: Microsoft 365, Google Workspace, Okta)
- Deploy AI-powered brand-impersonation and logo/visual-similarity detection to keep pace with AI-generated phishing assets that defeat manual visual inspection
- Extend security-awareness training to explicitly cover AI-tool subscription/billing lures (ChatGPT, other AI platforms) alongside traditional brand phishing
Timeline of Check Point Q2 2026 Brand Phishing Report
- Microsoft's Digital Crimes Unit, working with Europol and industry partners, disrupted hosting infrastructure behind the Tycoon2FA AiTM phishing-as-a-service platform, which had impersonated Microsoft 365, Outlook, SharePoint, OneDrive, Gmail, Azure, Okta and DocuSign sign-in pages at over 500,000 targeted organizations and 60M+ messages per month at peak.
- Start of the April-June 2026 data-collection window underlying Check Point's Q2 2026 Brand Phishing Report telemetry.
- Check Point observed a fake ChatGPT Plus payment-failure billing email mimicking OpenAI's legitimate notices, directing victims to a page built to harvest full credit-card details — a key example behind ChatGPT's first appearance in the top-10 impersonated brands.
- Check Point published its Q1 2026 Brand Phishing Report: Microsoft led at 22%, followed by Apple (11%), Google (9%), Amazon (7%) and LinkedIn (6%); technology was the most-impersonated sector.
- End of the April-June 2026 data-collection window underlying Check Point's Q2 2026 Brand Phishing Report telemetry.
- Check Point Research published the Q2 2026 Brand Phishing Report on its blog: Microsoft (23%), LinkedIn (11.6%), Google (6.7%), Apple (5.8%) and Amazon (5.2%) as the top five impersonated brands; ChatGPT entered the top 10 for the first time; technology, social networks and banking were the most-targeted sectors.
- IT-Online and other outlets began syndicating coverage of the Q2 2026 Brand Phishing Report findings.
- Help Net Security, Infosecurity Magazine, IT Voice and ITBrief published coverage of the Q2 2026 Brand Phishing Report, the source article tracked for this threat entry.
Sources cited for Check Point Q2 2026 Brand Phishing Report
- ChatGPT joins the most impersonated brands in phishing attacks
- Which Brands Are Impersonated Most? Inside the Q2 2026 Brand Phishing Report
- The Phishing Paradox: The World's Most Trusted Brands Are Cyber Criminals' Entry Point of Choice (Q1 2026 Brand Phishing Report)
- Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale
- Phishing Guidance: Stopping the Attack Cycle at Phase One (CISA/NSA/FBI/MS-ISAC)
- ChatGPT Among Top 10 Most Impersonated Brands in Phishing Attacks
- Check Point Research: Microsoft Leads Q2 2026 Brand Phishing as ChatGPT Emerges as a New Phishing Target
- Microsoft tops brand phishing list in Q2 2026 report
- ChatGPT joins Microsoft's phishing nightmare as fake OpenAI scams surge
- 'Darcula' Phishing Kit Can Now Impersonate Any Brand
- EvilProxy phishing campaign leverages convincing impersonations of enterprise applications
- AiTM Phishing in 2026 — How EvilProxy, Mamba, Tycoon, and Astaroth Defeat Microsoft 365 MFA
Detection coverage for TL-2026-1731
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1731 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.