Check Point’s latest Brand Phishing Report for Q1 2026 shows that Microsoft remains the most exploited brand in phishing attacks globally. With a whopping 22 percent of all phishing attempts targeting users worldwide, the report confirms a clear trend: cybercriminals are focusing on digital identities and cloud-based services.
The IT security company Check Point Software releases its latest Brand Phishing Report for Q1 2026. Microsoft retains the top spot, accounting for 22 percent of all phishing attacks globally. The company has held the top spot for a long time, demonstrating how consistently cybercriminals exploit trusted platforms.
Phishing continues to be one of the most common routes into organizations. The report shows how attackers systematically impersonate well-known brands to trick users into giving up login details. Behind Microsoft is Apple at 11 percent, followed by Google at 9 percent. Amazon and LinkedIn also rank high, reflecting how both consumer services and work-related platforms are being used as gateways to sensitive information.
The four most exploited brands together account for nearly half of all attacks. The technology sector continues to dominate, followed by social media and finance, demonstrating that digital identities and cloud services are some of the most valuable targets for attackers.
Several advanced campaigns were identified during the quarter. In one case, long and misleading URLs were used to mimic Microsoft’s sign-in service and collect data. In another, WhatsApp was exploited, tricking users into scanning a QR code, which gave attackers access to their accounts. Fake online stores and manipulated software downloads were also used to carry out fraud and spread malware.
This development is driven by the fact that more and more services are linked to the same digital identity. A hijacked account can provide access to email, collaboration tools and business-critical information. This makes phishing an effective first step in more extensive attacks.
– Microsoft's continued top spot shows how central identities and cloud services have become to attackers, says Oscar Rodin, security expert at Check Point Software. At the same time, we see platforms like LinkedIn growing in importance, which points to an increased focus on corporate environments. Reducing risks requires proactive security work where threat information and protection are integrated into the entire digital work environment.
The most imitated companies in the first quarter of 2026
- Microsoft – 22%
- Apple – 11%
- Google – 9%
- Amazon – 7%
- LinkedIn – 6%
- Dropbox – 2%
- Facebook – 2%
- WhatsApp – 1%
- Tesla – 1%
- YouTube – 1%
The report is based on data from Check Point Research and their global threat platform ThreatCloud.
A more detailed description can be found at Check Point blog.
Swedish
Danish
Norwegian
Finnish
English
German
Dutch