# Check Point Q2 2026 Brand Phishing Report: Microsoft Leads at 23%, ChatGPT Enters Top 10 Impersonated Brands

> Check Point Research's Q2 2026 Brand Phishing Report found Microsoft impersonated in 23% of tracked brand-phishing attempts, with LinkedIn (11.6%), Google (6.7%), Apple (5.8%) and Amazon (5.2%) rounding out a top five that together accounts for over half of all attempts. Technology, social networks and banking were the most-impersonated sectors, and ChatGPT entered the top 10 impersonated brands for the first time as attackers pivot toward AI-tool subscription and payment lures.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1731
- **ID:** TL-2026-1731
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Check Point Research's Q2 2026 Brand Phishing Report (published on the Check Point blog 2026-07-23, covering the April-June 2026 data-collection window) tracks which real-world brands are most frequently spoofed across phishing emails and fraudulent websites. Microsoft again topped the list at 23% of tracked attempts (up marginally from 22% in Q1 2026), with a campaign example built around a fraudulent Microsoft support page urging an 'urgent Office security update' that instead delivered a malware executable. LinkedIn moved into second place at 11.6% (nearly double its 6% Q1 2026 share), ahead of Google (6.7%), Apple (5.8%, down from 11% in Q1) and Amazon (5.2%) — the top five together covering more than half of all observed brand-phishing activity.

The headline development is ChatGPT/OpenAI entering the top 10 impersonated brands for the first time. Check Point documented a fake ChatGPT Plus subscription payment-failure billing email that mimicked OpenAI's legitimate notices and funneled victims to a credential-harvesting page engineered to capture full credit-card details. Check Point's analysts characterize this as 'a strong signal of where attacker attention is heading next,' arguing that as AI platforms become embedded in everyday subscription, payment and work-task workflows they become targets on par with legacy tech giants.

Other documented Q2 2026 campaign examples span consumer retail and identity brands: a full replica Michael Kors e-commerce site cloning browsing/cart/checkout; a counterfeit regional UNIQLO storefront with non-functional links back to the brand's real social accounts; a Russian-language fake Apple iCloud login page with a non-functional sign-in button (suggesting a still-in-testing kit build); and a near-identical PayPal login-page clone carrying a visibly distorted, likely AI-generated PayPal logo. Across campaigns, Check Point flags a consistent pattern: urgency framing (payment failures, security alerts, forced updates), subtle visual flaws (distorted logos, broken buttons, mismatched domains), and increasingly convincing AI-generated page/logo assets that erode the reliability of visual-inspection-based user training.

This report is a quarterly trend/telemetry publication rather than a single exploited vulnerability, but it sits on top of an active, industrial phishing-as-a-service (PhaaS) ecosystem that supplies the infrastructure for exactly this kind of brand-impersonation campaign at scale — kits such as Tycoon2FA, EvilProxy and Darcula auto-generate cloned, brand-accurate phishing pages and, in the AiTM (adversary-in-the-middle) cases, relay credentials and session cookies through a reverse proxy to defeat MFA in real time. Microsoft's Digital Crimes Unit and Europol disrupted Tycoon2FA's hosting infrastructure in March 2026 after it reached over 500,000 targeted organizations and 60M+ phishing messages per month at its peak; Check Point's Q2 2026 data shows the brand-impersonation problem itself unabated even after that individual kit's disruption, with attacker focus now also expanding into Microsoft Teams-based social engineering.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.001 Domains
- T1585.002 Email Accounts
- T1608.001 Upload Malware
- T1608.005 Link Target
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1098.002 Additional Email Delegate Permissions
- T1098.005 Device Registration
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1056.003 Web Portal Capture
- T1071.001 Web Protocols

## Sources

- [ChatGPT joins the most impersonated brands in phishing attacks](https://www.helpnetsecurity.com/2026/07/27/check-point-brand-phishing-trends-report/)
- [Which Brands Are Impersonated Most? Inside the Q2 2026 Brand Phishing Report](https://blog.checkpoint.com/research/which-brands-are-impersonated-most-inside-the-q2-2026-brand-phishing-report)
- [The Phishing Paradox: The World's Most Trusted Brands Are Cyber Criminals' Entry Point of Choice (Q1 2026 Brand Phishing Report)](https://blog.checkpoint.com/research/the-phishing-paradox-the-worlds-most-trusted-brands-are-cyber-criminals-entry-point-of-choice/)
- [Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/)
- [Phishing Guidance: Stopping the Attack Cycle at Phase One (CISA/NSA/FBI/MS-ISAC)](https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one)
- [ChatGPT Among Top 10 Most Impersonated Brands in Phishing Attacks](https://www.infosecurity-magazine.com/news/chatgpt-most-impersonated-brands/)
- [Check Point Research: Microsoft Leads Q2 2026 Brand Phishing as ChatGPT Emerges as a New Phishing Target](https://www.itvoice.in/check-point-research-microsoft-leads-q2-2026-brand-phishing-as-chatgpt-emerges-as-a-new-phishing-target)
- [Microsoft tops brand phishing list in Q2 2026 report](https://itbrief.co.uk/story/microsoft-tops-brand-phishing-list-in-q2-2026-report)
- [ChatGPT joins Microsoft's phishing nightmare as fake OpenAI scams surge](https://cybernews.com/security/chatgpt-joins-microsofts-phishing-nightmare/)
- ['Darcula' Phishing Kit Can Now Impersonate Any Brand](https://www.darkreading.com/threat-intelligence/darcula-phishing-kit-impersonate-brand)
- [EvilProxy phishing campaign leverages convincing impersonations of enterprise applications](https://www.okta.com/blog/threat-intelligence/evil-proxy-phishing-campaign/)
- [AiTM Phishing in 2026 — How EvilProxy, Mamba, Tycoon, and Astaroth Defeat Microsoft 365 MFA](https://ringsafe.in/aitm-phishing-in-2026-how-evilproxy-mamba-tycoon-and-astaroth-defeat-microsoft-365-mfa/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1731