Microsoft remained the world’s most impersonated brand in phishing attacks during the second quarter of 2026, while ChatGPT entered the rankings for the first time as cybercriminals increasingly exploit trusted brands and AI platforms to steal users’ personal and financial information.
This is according to the latest Brand Phishing Ranking for Q2 2026 from Check Point Research (CPR), the threat intelligence arm of Check Point Software Technologies.
In Q2 2026, LinkedIn ranked second at 11.6%, followed by Google at 6.7%, Apple at 5.8% and Amazon at 5.2%. Together, the top five most impersonated brands accounted for more than half of all brand phishing activity tracked this quarter, underscoring how attackers are focusing on a small group of globally recognised platforms that people use and trust every day.
Notably, Open AI’s ChatGPT made the top 10 list for the first time, marking a clear signal that AI tools are now firmly on cybercriminals’ radar. As AI platforms become part of daily workflows for subscriptions, payments and workplace tasks, they are becoming attractive targets for phishing campaigns in the same way as established technology and financial brands.
By industry, Technology remained the most impersonated sector, followed by Social Networks and Banking, reflecting attackers’ continued focus on platforms that hold users’ identities, professional relationships and money.
Omer Dembinsky, data research manager at Check Point Research said, “Brand phishing is entering a new phase where attackers are not only exploiting trust in household technology names, but also moving quickly toward the AI platforms people are beginning to rely on every day. As generative AI enables criminals to create more credible emails, cloned websites and fake digital experiences at scale, organisations must shift from reacting after compromise to preventing these threats before users ever engage with them.”
Top 10 Most Imitated Brands in Phishing – Q2 2026
- Microsoft – 22.6%
- LinkedIn – 11.6%
- Google – 6.7%
- Apple – 5.8%
- Amazon – 5.2%
- Adobe – 3.8%
- Facebook – 1.9%
- WhatsApp – 1.4%
- PayPal – 1.3%
- ChatGPT – 1.1%
Real-World Phishing Campaigns Observed in Q2 2026
The Q2 2026 report highlights a wide range of brand phishing techniques, from fake payment failure notices to replica online stores, fraudulent login pages and malware disguised as software updates.
One campaign impersonated ChatGPT Plus through a fake subscription payment failure email that led victims to a page designed to steal full credit card details. Another campaign used a lookalike Michael Kors online store that replicated the shopping journey, including browsing, cart and checkout, to capture payment information under the appearance of a legitimate purchase.
Why brand phishing is becoming harder to spot
Brand phishing works because it transfers trust from a familiar organisation to a fraudulent message or website. Across Q2 2026 cases, attackers used urgency, realistic branding, lookalike domains, broken buttons, mismatched links and subtle visual flaws to lower user suspicion and drive faster action.
Generative AI is also changing the economics of brand phishing by helping attackers produce more convincing emails and fraudulent websites at scale, making both the volume and sophistication of these attacks likely to grow. With generative AI lowering the barrier to creating convincing fake websites, emails and digital experiences, brand phishing is becoming harder to detect and easier to scale. As trust becomes the primary target, organisations must assume these attacks will continue to grow in both volume and sophistication.
