One phishing email in three now wears Microsoft's name

Check Point Research published its third-quarter brand phishing numbers this week, and one figure dominates. A third of every impersonation attempt the firm tracked between July and September used Microsoft's name. That is 33 percent, up from 23 percent in the second quarter, and roughly four times the share of any other brand. Apple and Google tied for second at 8 percent each, LinkedIn took 6 percent, YouTube climbed five places into sixth and Dropbox jumped ten into eighth.

Microsoft's lead has a dull explanation. One stolen Microsoft password usually opens email, files and whatever is stored alongside them, while most of the other names on the list get an attacker into a single account and no further. Technology was the most impersonated sector overall, followed by social networks and banking.

What Check Point's examples show is a shift in the ask. A fake billing notice for the AI assistant Claude, sent from billing-update@account-notif[.]com, claimed a 500 euro payment had failed. A lookalike domain, antigravity-ide-google[.]com, served a base64-encoded install command. A spoofed apple-support[.]today page walked visitors through typing commands into a terminal. And a cluster of Docusign fakes, including docusigninstalleradmin[.]help, handed out FleetDeck, a genuine remote-management tool, dressed up as a document reader update.

That last pattern is the one worth memorising. A password page at least looks like a login. A support page that asks you to paste a command, or to install a small helper so someone can "fix" your account, has skipped straight to taking the machine. No real company does either. If something has already been installed on that basis, Tendvane's Safety check lists unwanted programs and remote-access tools sitting on your PC, which is usually where the damage first becomes visible.