Loading story…
Check Point reported that Microsoft remained the most impersonated brand in phishing attacks in Q2 2026, accounting for 22.6% of observed attempts, while ChatGPT entered the top 10 for the first time at about 1.1%. The report said technology companies were the most targeted sector, alongside continued abuse of well-known consumer and social platforms including PayPal, WhatsApp, and Facebook.
Researchers highlighted a June campaign in which attackers sent a fake ChatGPT Plus payment-failure email that imitated an OpenAI billing notice and redirected victims to a fraudulent credit-card harvesting page. Other campaigns included a cloned Michael Kors storefront, a fake UNIQLO site, and a bogus Microsoft support page that delivered malware disguised as an Office security update, showing how attackers relied on urgency around billing problems, security alerts, and required updates to drive victims into surrendering credentials, payment data, or installing malicious software.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The Q2 2026 report said ChatGPT entered the top 10 most impersonated brands for the first time, accounting for about 1.1% of tracked phishing attempts.
Check Point released its Q2 2026 Brand Phishing Report, finding Microsoft remained the most impersonated brand at 22.6% of tracked phishing attempts and that technology companies were the most targeted sector during the quarter.
Check Point described a June phishing case in which attackers sent a fake ChatGPT Plus payment failure email impersonating an OpenAI billing notice and redirected victims to a fraudulent credit-card harvesting page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence reported that threat actors are exploiting the popularity of AI platforms including **ChatGPT**, **Claude**, **DeepSeek**, and **Flux Pro AI** to drive phishing, malvertising, and malware delivery rather than compromising the vendors themselves. One ChatGPT-themed campaign, aimed largely at South African users, used payment-update emails and redirect chains through legitimate services to a compromised site that harvested personal and credit card data. A separate Claude-themed operation targeted more than 2,000 organizations and likely used adversary-in-the-middle techniques to steal Microsoft sign-in credentials and authentication tokens. Microsoft also linked large-scale AI-themed malvertising to **Storm-3075**, which pushed fake AI plugin downloads and delivered malware including **Vidar Stealer**, **Lumma Stealer**, **Hijack Loader**, and **Oyster**, with parts of the chain tied to **Fox Tempest** malware-signing services. In another case, attackers created a fake **DeepSeek V4** GitHub repository within hours of the model’s launch, using copied benchmark data, official-looking branding, SEO tactics, and rotating payloads to distribute **Vidar** and **GhostSocks** malware before GitHub removed the infrastructure. Microsoft said it revoked certificates, disrupted Fox Tempest infrastructure with partners, and coordinated takedowns, while urging defenders to strengthen MFA, conditional access, browser protections, and endpoint and email defenses.
Jun 29, 2026
Threat researchers reported continued growth and diversification in **impersonation-driven phishing**. Guardio data cited by KnowBe4 identified **Microsoft** as the most impersonated brand in phishing during **Q4 2025**, followed by **Facebook, Roblox, McAfee, Steam, AT&T, Amazon, Google, Yahoo, and Coinbase**. The activity reportedly surged around high-traffic seasonal moments (e.g., Black Friday “storefront” scams, December delivery scams, and January job-search lures), reflecting attackers’ focus on exploiting predictable user behavior and time-sensitive themes. Separately, LevelBlue **SpiderLabs** reported **BEC** activity increased **15% in 2025 vs. 2024** based on *MailMarshal* telemetry, averaging **3,000+ BEC messages/month** (peaking at **4,300** in July). The report noted seasonal/operational timing effects (e.g., quarter transitions and summer vacation staffing gaps) and highlighted evolving tactics including **“contact details swapping,”** where attackers impersonate finance teams to “update” official contact information to redirect payments or communications. Together, the reporting indicates sustained growth in **impersonation and social engineering** as a primary driver of fraud and account compromise risk, with attackers adapting lures to business cycles and consumer seasons.
Jun 29, 2026
Multiple reports highlight **social engineering and phishing** as primary initial-access vectors, with attackers increasingly targeting **identity systems** rather than exploiting software vulnerabilities. Microsoft was again the most spoofed brand in phishing during Q4 2025 (22% of observed brand-impersonation attempts), reflecting how attackers abuse trust in major identity and productivity platforms to harvest credentials; examples cited include lures mimicking Netflix account recovery, Roblox-related pages, and Spanish-language Facebook scams. Separately, an incident response case described payroll fraud achieved without malware or a network breach: an attacker impersonated employees to help desks, reset passwords, re-enrolled MFA, and registered an external email as an authentication method in **Azure Active Directory**, then altered direct-deposit details to redirect paychecks—underscoring how **help-desk processes and MFA reset workflows** can be exploited for persistence and financial theft. Targeted campaigns also show continued evolution in delivery tradecraft for **remote access**. A spear-phishing operation against Argentina’s judicial sector used ZIP attachments containing a weaponized Windows shortcut (`.lnk`) masquerading as a PDF plus scripts and a decoy court document to deploy a **Remote Access Trojan** while minimizing user suspicion. In parallel, research described **Pulsar RAT** (a Quasar RAT derivative) emphasizing stealth via **memory-only execution** and **HVNC**, with TLS-encrypted C2 and configuration retrieval from public paste sites, alongside persistence mechanisms such as scheduled tasks and UAC-bypass techniques. Another campaign attributed to **Konni APT** (“Operation Poseidon”) abused **Google and Naver ad redirection** (e.g., `ad.doubleclick[.]net`, `mkt.naver[.]com`) to launder clicks through trusted ad infrastructure before landing victims on compromised sites hosting malware, demonstrating how open-redirect and ad-tech trust can bypass reputation-based controls.
Jun 29, 2026