/
← Voltar ao feed
medium technology social networks banking general

Q3 2026 brand phishing: Microsoft hits 33% of impersonation; lures target Claude, Antigravity, Apple, Docusign users

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 10:00 · coletado há 2 dias

Check Point Research's Q3 2026 Brand Phishing Report finds Microsoft was the most impersonated brand, at 33% of all attempts (up from 23% in Q2) and roughly four times the share of any other brand. Apple, Google, LinkedIn and Amazon completed the top five, together accounting for more than half of attempts. Dropbox (up ten places to eighth) and YouTube (up five to sixth) entered the top 10. Technology was the most impersonated sector, followed by Social Networks and Banking. The report highlights new lures aimed at AI and developer tool users, and campaigns that persuade victims to run terminal commands or install remote access software themselves.

Detalhes técnicos

  • Claude lure: an October 2026 email from billing-update@account-notif[.]com with the subject "Payment failed for your Claude account" claims a €500.00 payment was declined and that API access and seats will be paused. An "Update payment method" button leads to a fraudulent payment and credential harvesting flow.
  • Google Antigravity lure: antigravity-ide-google[.]com (registered September 2026) shows a Linux install command that decodes and runs a Base64 command, which downloads and executes a shell script from an external server, giving the attacker RCE.
  • Apple lure: apple-support[.]today (registered September 2026) clones Apple's site with the article "Boost your Mac using the terminal", aiming to get users to run malicious terminal commands. The legitimate site is support.apple.com.
  • Docusign lure: a set of domains registered from September into early October 2026 (e.g. docusigninstalleradmin[.]help, docusignsinstaller[.]help) shows a fake "Update Required" Docusign Reader prompt that downloads fleetdeck_installer. FleetDeck is a legitimate RMM tool, so its use suggests the goal is unauthorized remote access.

Remediação

  • Block phishing inline before it reaches the inbox, and use AI-based detection for brand impersonation, BEC, credential harvesting and QR code phishing.
  • Monitor for RMM tools not approved by IT, since legitimate RMM software is being abused for access.
  • Educate users not to paste terminal commands from websites or install "updates" from unsolicited pages.
  • Scan for lookalike domains and cloned login pages and use fast takedown processes.

Linha do tempo

  1. blog.checkpoint.com ↗ · pub. 16/10/2026 10:00 · coletado 19/10 17:57 primeiro registro

    Q3 2026 brand phishing: Microsoft hits 33% of impersonation; lures target Claude, Antigravity, Apple, Docusign users

    ler a análise desta fonte

    Check Point Research's Q3 2026 Brand Phishing Report finds Microsoft was the most impersonated brand, at 33% of all attempts (up from 23% in Q2) and roughly four times the share of any other brand. Apple, Google, LinkedIn and Amazon completed the top five, together accounting for more than half of attempts. Dropbox (up ten places to eighth) and YouTube (up five to sixth) entered the top 10. Technology was the most impersonated sector, followed by Social Networks and Banking. The report highlights new lures aimed at AI and developer tool users, and campaigns that persuade victims to run terminal commands or install remote access software themselves.

    Technical Details

    • Claude lure: an October 2026 email from billing-update@account-notif[.]com with the subject "Payment failed for your Claude account" claims a €500.00 payment was declined and that API access and seats will be paused. An "Update payment method" button leads to a fraudulent payment and credential harvesting flow.
    • Google Antigravity lure: antigravity-ide-google[.]com (registered September 2026) shows a Linux install command that decodes and runs a Base64 command, which downloads and executes a shell script from an external server, giving the attacker RCE.
    • Apple lure: apple-support[.]today (registered September 2026) clones Apple's site with the article "Boost your Mac using the terminal", aiming to get users to run malicious terminal commands. The legitimate site is support.apple.com.
    • Docusign lure: a set of domains registered from September into early October 2026 (e.g. docusigninstalleradmin[.]help, docusignsinstaller[.]help) shows a fake "Update Required" Docusign Reader prompt that downloads fleetdeck_installer. FleetDeck is a legitimate RMM tool, so its use suggests the goal is unauthorized remote access.

    Remediation

    • Block phishing inline before it reaches the inbox, and use AI-based detection for brand impersonation, BEC, credential harvesting and QR code phishing.
    • Monitor for RMM tools not approved by IT, since legitimate RMM software is being abused for access.
    • Educate users not to paste terminal commands from websites or install "updates" from unsolicited pages.
    • Scan for lookalike domains and cloned login pages and use fast takedown processes.