Threat reportPhishingTL-2026-3872
Check Point Q3 2026 Brand Phishing Report: Microsoft Most Impersonated (33%), Fake Claude, Antigravity, Apple and DocuSign Lures
Check Point Q3 2026 Brand Phishing Report (TL-2026-3872), also tracked as Q3 2026 Brand Phishing Report, is a medium-severity phishing campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Microsoft accounts (impersonated brand), maps to 7 MITRE ATT&CK techniques (T1059.004, T1204.001, T1204.004), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3872
- Threat ID
- TL-2026-3872
- Also known as
- Q3 2026 Brand Phishing Report
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, social-media, banking, enterprise, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Check Point Q3 2026 Brand Phishing Report
Malware and tooling: FleetDeck.io
How Check Point Q3 2026 Brand Phishing Report works
Check Point Research's Q3 2026 Brand Phishing Report ranks Microsoft as the most impersonated brand at 33% of attempts (up from 23% in Q2 2026), ahead of Apple (8%) and Google (8%). Observed lures include a fake Claude payment-failure email, a fake Google Antigravity site pushing a malicious Linux install command, a cloned Apple support site urging Terminal commands, and DocuSign-themed update prompts that deliver the FleetDeck remote monitoring and management (RMM) tool.
Check Point Research published its Q3 2026 Brand Phishing Report on 2026-10-16 (Check Point blog), with press coverage by Help Net Security on 2026-10-19. Microsoft led the quarter's brand impersonation ranking with a 33% share, up from 23% in Q2 2026. Apple rose two places to second with 8%, tied with Google in third at 8%; LinkedIn dropped two places to fourth with 6%. Amazon also made the top five, and the top five brands together accounted for more than half of all attempts. Dropbox climbed from outside the top 10 to eighth place and YouTube rose five places to sixth. Technology companies were the most impersonated sector, followed by social networks and banking. Check Point's stated rationale for Microsoft's lead is that stolen Microsoft credentials can unlock an entire corporate environment (email, files and collaboration tools), whereas many other top brands mainly lead to personal accounts.
The report highlights a shift in which attackers follow users into AI and developer tools and go beyond password theft by persuading victims to run terminal commands or install remote access software themselves. Four lures are described. (1) Claude: an email with the subject 'Payment failed for your Claude account', sent from billing-update@account-notif.com, claims a EUR 500 payment was declined and redirects to a fraudulent payment form to collect payment details and account credentials (observed October 2026). (2) Google Antigravity: a lookalike site at antigravity-ide-google.com, registered September 2026, displays a Linux installation command that downloads and executes a shell script from an external server, giving the attacker remote code execution on the victim's system. (3) Apple: apple-support.today, registered September 2026, copies Apple's branding and navigation and hosts an article titled 'Boost your Mac using the terminal' that promises performance gains in order to get users to run malicious commands themselves. (4) DocuSign: lure pages on docusigninstalleradmin.help and docusignsinstaller.help (registered September to early October 2026) present a document-review flow with a 'Docusign Reader update needed' prompt that delivers a FleetDeck installer. FleetDeck is a legitimate RMM product, so the resulting access is hard to distinguish from authorized administration without an approved-tool inventory.
The sources name no CVEs, threat actors, or malware families; this is a brand-impersonation trend report, not a single campaign, so actor attribution fields are Unknown. Independent reporting (Help Net Security, 2026-10-05) shows RMM abuse is a broader trend, with RMM software used in 45% of endpoint incidents in Q1 2026 in the data cited there; that article does not mention FleetDeck. Cofense and other vendors have documented FleetDeck abuse in phishing since summer 2024. BeaconBeagle queries for antigravity-ide-google.com and docusignsinstaller.help returned no C2 configuration matches.
Defender takeaways from Check Point: deploy inline phishing prevention before inbox delivery, use AI-assisted detection for brand impersonation and credential harvesting, protect both Microsoft 365 and Google Workspace, automate investigation and response, and monitor for unapproved remote management tools. Severity is an analyst estimate, not stated in the source.
MITRE ATT&CK techniques used in TL-2026-3872
Execution
T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.004 Malicious Copy and Paste
Command and Control
Initial Access
Resource Development
Defense Evasion
Affected products and versions in Check Point Q3 2026 Brand Phishing Report
Remediation for Check Point Q3 2026 Brand Phishing Report
Immediate actions
- Block the domains account-notif.com, antigravity-ide-google.com, apple-support.today, docusigninstalleradmin.help and docusignsinstaller.help at DNS, proxy and email gateways
- Search mail logs for the subject 'Payment failed for your Claude account' and sender billing-update@account-notif.com, and purge matching messages
- Hunt endpoints for FleetDeck installation or execution that is not on the approved RMM list
- Reset credentials and review sign-ins for any user who entered credentials or payment details on a lure page
Workarounds
- Restrict installation of remote access software through application control or allow-listing
- Verify billing and installation instructions only through the vendor's official site or app, not through email links
Longer-term hardening
- Maintain an inventory of approved RMM tools and alert on any unapproved remote management software
- Deploy inline phishing prevention that evaluates mail before inbox delivery
- Train users never to paste terminal commands from websites or support articles, including AI and developer tool install instructions
- Enforce phishing-resistant MFA on Microsoft 365 and Google Workspace accounts
Timeline of Check Point Q3 2026 Brand Phishing Report
- Check Point's Q2 2026 Brand Phishing Report (published earlier in 2026) recorded Microsoft at 23% of brand phishing attempts, the baseline for the Q3 increase.
- Lookalike domains antigravity-ide-google.com and apple-support.today registered in September 2026; DocuSign-themed installer domains registered September to early October 2026 (exact dates not stated in the source).
- DocuSign-themed lures delivering FleetDeck via a 'Docusign Reader update needed' prompt observed in September to October 2026 (month-level date; day not stated).
- Fake 'Payment failed for your Claude account' email (EUR 500 declined payment) observed in October 2026 (month-level date; day not stated).
- Help Net Security reports RMM software used in 45% of endpoint incidents in Q1 2026, giving context for the FleetDeck lure.
- Check Point publishes 'Inside the Q3 2026 Brand Phishing Report': Microsoft at 33%, Apple and Google at 8% each, LinkedIn at 6%.
- Help Net Security covers the report, highlighting Microsoft's rise from 23% to 33% and the AI/developer-tool and RMM lures.
Sources cited for Check Point Q3 2026 Brand Phishing Report
- Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation (Check Point Blog)
- Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks (Help Net Security)
- Check Point Research: Microsoft accounts for one in three Brand Phishing attempts in Q3 2026 (CXO Insight ME)
- Microsoft tops brand phishing list in Q2 2026 report (IT Brief Australia)
- How RMM abuse gives attackers a way in that looks like business as usual (Help Net Security)
- New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools (Cofense)
Detection coverage for TL-2026-3872
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3872 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.