One cybersecurity firm’s customer base data show the trends for the last quarter, including newer tactics that make spotting brand-phishing difficult.

Phishing campaigns are constantly targeting well-known technology, social media, banking, and now AI brands, according to one cybersecurity vendor’s own customer base telemetry. According to its Q2 2026 data, the most impersonated brand — accounting for 22.6% of observed brand phishing attempts — was Microsoft, followed by LinkedIn (11.6%), Google (6.7%), Apple (5.8%) and Amazon (5.2%).

The telemetry report includes a range of tactics used in the second quarter, including fake payment failure notices; replica online stores; fraudulent login pages; and malicious software update prompts. Examples cited include a counterfeit ChatGPT Plus billing page; a lookalike Michael Kors storefront; a fake UNIQLO regional site; a spoofed Apple iCloud login page; a distorted PayPal login page; and a fake Microsoft support page that delivered an executable file.

Ranked by sector, technology remains the most impersonated category, with social networks and banking also prominent. The common thread is trust: Phishing succeeds by borrowing the credibility of a familiar brand and using urgency, visual similarity, and subtle interface flaws to push users into acting before they think.

The report also argues that generative AI is making these campaigns easier to produce and more convincing at scale, lowering the barrier to creating fake emails, websites, and digital experiences. Brand phishing may become harder to spot  because, according to the report, it transfers trust from a familiar organization to a fraudulent message or website. Attackers use urgency, realistic branding, lookalike domains, broken buttons, mismatched links and subtle visual flaws to lower user suspicion and drive faster action. As trust becomes the primary target, organizations will have to assume these attacks will continue to grow in both volume and sophistication.

The findings, released by Check Point Research, should be read as a snapshot of what one vendor has observed in its own user base and operational environment, not as a neutral global measurement* or an independent sample of the broader internet.

*Rankings can reflect observed telemetry; however, brand impersonation is shaped not only by consumer awareness, but also by attacker economics; lure reusability; infrastructure availability; detection and takedown speed; and how deeply a brand sits inside everyday login, payment, security and support workflows.