33% of Q3 phishing targets Microsoft: Credentials unlock corporate environments

Security operations teams must account for a significant shift in attacker focus during the third quarter of 2026. According to Check Point Research, Microsoft accounted for 33% of all brand impersonation attempts tracked during this period. This figure represents a substantial increase from the 23% share recorded in the previous quarter. Microsoft’s share was roughly four times larger than that of any other individual brand. This concentration of activity suggests that defenders should expect a high volume of Microsoft-centric phishing traffic.

Why are attackers targeting Microsoft so heavily?

The research team explained that attackers favor Microsoft because stolen credentials can unlock an entire corporate environment. This access includes email, files, and collaboration tools, which are central to business operations. In contrast, many other top impersonated brands mainly lead to personal accounts that offer less strategic value to threat actors. Technology brands were impersonated most often overall, followed by social networks and banking institutions. This hierarchy of targets reflects the potential impact of a breach on organizational infrastructure.

Which other brands saw increased attention?

Apple and Google followed Microsoft in the rankings, with each accounting for 8% of attempts. Dropbox and YouTube recorded the biggest climbs in the rankings during the quarter. Outside the main quarterly data, specific campaigns emerged in September and October 2026. These included a phishing email using Claude and Anthropic branding to claim a €500 payment had been declined. The message warned that API access and Claude seats would be paused unless payment methods were updated.

What new impersonation tactics are emerging?

Attackers registered a website impersonating Google Antigravity in September, displaying a Linux installation command that downloaded and executed a script from an external server. Another site copied Apple’s branding and support content, directing visitors to an article promising performance improvements via malicious terminal commands. Websites impersonating Docusign also appeared in September and early October. One displayed a document requiring a Docusign Reader update, which actually downloaded a FleetDeck installer to gain unauthorized access to the victim’s computer.

What does this mean for defense strategies?

The surge in Microsoft-related phishing indicates that credential theft remains a primary objective for cybercriminals. The use of legitimate-sounding prompts, such as payment failures or software updates, makes these attacks particularly difficult to distinguish from normal business communications. The inclusion of remote monitoring tools like FleetDeck in Docusign impersonations highlights a shift toward gaining persistent access to devices. Defenders must remain vigilant against these evolving tactics that blend social engineering with technical exploitation.

Detection notes

Teams usually monitor for unusual login patterns from unfamiliar locations or devices, which often signal compromised credentials. Security analysts should check email gateways for links to newly registered domains that mimic legitimate brand support pages. Behavioral alerts for the execution of unexpected scripts or remote management tools can reveal successful phishing attempts. Incident responders typically isolate affected endpoints to prevent lateral movement and reset compromised credentials immediately. Regular review of user activity logs helps identify anomalous access to sensitive files or collaboration tools before significant damage occurs.

Background: Phishing

You fall for phishing when you trust visual cues over technical indicators. Verify the domain in the address bar, check for HTTPS certificates, and disable auto-login features. These small habits stop attackers from stealing credentials or installing malware through deceptive links and attachments.

Read the full guide: 7 Phishing Mistakes That Bypass Your Defenses

What to do and how to stay safe: Microsoft

• Monitor email logs for messages claiming payment failures or requiring urgent software updates, especially from unexpected senders.
• Verify the legitimacy of any requests to run terminal commands or install remote management tools by contacting the vendor directly.
• Enforce multi-factor authentication on all Microsoft accounts to add a layer of security even if credentials are stolen.
• Review browser history and installed applications on endpoints that interacted with suspicious links to identify potential malware.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much did Microsoft's share of phishing attempts increase in Q3 2026?

Microsoft's share increased from 23% in the previous quarter to 33% in the third quarter of 2026.

Why do attackers prefer stealing Microsoft credentials over others?

Stolen Microsoft credentials can unlock an entire corporate environment, including email, files, and collaboration tools.

What tool was distributed through the fake Docusign website?

A FleetDeck installer was distributed, which is a remote monitoring and management product that can be abused for unauthorized access.