# Check Point Q3 2026 Brand Phishing Report: Microsoft Most Impersonated (33%), Fake Claude, Antigravity, Apple and DocuSign Lures

> Check Point Research's Q3 2026 Brand Phishing Report ranks Microsoft as the most impersonated brand at 33% of attempts (up from 23% in Q2 2026), ahead of Apple (8%) and Google (8%). Observed lures include a fake Claude payment-failure email, a fake Google Antigravity site pushing a malicious Linux install command, a cloned Apple support site urging Terminal commands, and DocuSign-themed update prompts that deliver the FleetDeck remote monitoring and management (RMM) tool.

- **Published:** 2026-10-19T10:00:22Z
- **Last reviewed:** 2026-10-19T10:00:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3872
- **ID:** TL-2026-3872
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Check Point Research published its Q3 2026 Brand Phishing Report on 2026-10-16 (Check Point blog), with press coverage by Help Net Security on 2026-10-19. Microsoft led the quarter's brand impersonation ranking with a 33% share, up from 23% in Q2 2026. Apple rose two places to second with 8%, tied with Google in third at 8%; LinkedIn dropped two places to fourth with 6%. Amazon also made the top five, and the top five brands together accounted for more than half of all attempts. Dropbox climbed from outside the top 10 to eighth place and YouTube rose five places to sixth. Technology companies were the most impersonated sector, followed by social networks and banking. Check Point's stated rationale for Microsoft's lead is that stolen Microsoft credentials can unlock an entire corporate environment (email, files and collaboration tools), whereas many other top brands mainly lead to personal accounts.

The report highlights a shift in which attackers follow users into AI and developer tools and go beyond password theft by persuading victims to run terminal commands or install remote access software themselves. Four lures are described. (1) Claude: an email with the subject 'Payment failed for your Claude account', sent from billing-update@account-notif.com, claims a EUR 500 payment was declined and redirects to a fraudulent payment form to collect payment details and account credentials (observed October 2026). (2) Google Antigravity: a lookalike site at antigravity-ide-google.com, registered September 2026, displays a Linux installation command that downloads and executes a shell script from an external server, giving the attacker remote code execution on the victim's system. (3) Apple: apple-support.today, registered September 2026, copies Apple's branding and navigation and hosts an article titled 'Boost your Mac using the terminal' that promises performance gains in order to get users to run malicious commands themselves. (4) DocuSign: lure pages on docusigninstalleradmin.help and docusignsinstaller.help (registered September to early October 2026) present a document-review flow with a 'Docusign Reader update needed' prompt that delivers a FleetDeck installer. FleetDeck is a legitimate RMM product, so the resulting access is hard to distinguish from authorized administration without an approved-tool inventory.

The sources name no CVEs, threat actors, or malware families; this is a brand-impersonation trend report, not a single campaign, so actor attribution fields are Unknown. Independent reporting (Help Net Security, 2026-10-05) shows RMM abuse is a broader trend, with RMM software used in 45% of endpoint incidents in Q1 2026 in the data cited there; that article does not mention FleetDeck. Cofense and other vendors have documented FleetDeck abuse in phishing since summer 2024. BeaconBeagle queries for antigravity-ide-google.com and docusignsinstaller.help returned no C2 configuration matches.

Defender takeaways from Check Point: deploy inline phishing prevention before inbox delivery, use AI-assisted detection for brand impersonation and credential harvesting, protect both Microsoft 365 and Google Workspace, automate investigation and response, and monitor for unapproved remote management tools. Severity is an analyst estimate, not stated in the source.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1219 Remote Access Tools

## Sources

- [Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation (Check Point Blog)](https://blog.checkpoint.com/security/inside-the-q3-2026-brand-phishing-report-microsoft-now-accounts-for-one-in-three-brand-impersonation)
- [Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks (Help Net Security)](https://www.helpnetsecurity.com/2026/10/19/check-point-brand-impersonation-scams-q3-2026-report/)
- [Check Point Research: Microsoft accounts for one in three Brand Phishing attempts in Q3 2026 (CXO Insight ME)](https://www.cxoinsightme.com/future/tech/check-point-research-microsoft-accounts-for-one-in-three-brand-phishing-attempts-in-q3-2026/)
- [Microsoft tops brand phishing list in Q2 2026 report (IT Brief Australia)](https://itbrief.com.au/story/microsoft-tops-brand-phishing-list-in-q2-2026-report)
- [How RMM abuse gives attackers a way in that looks like business as usual (Help Net Security)](https://helpnetsecurity.com/2026/10/05/remote-monitoring-and-management-rmm-abuse)
- [New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools (Cofense)](https://cofense.com/blog/new-weapon-of-choice-how-threat-actors-hijack-legitimate-remote-access-tools)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3872