Most Impersonated Brands in Phishing: 2026 Report Data

The most impersonated brands in phishing in 2026, from Check Point, Guardio, APWG and Kaspersky reports, with each list's period and what it actually counts.

Quick answer: According to Check Point Research's Brand Phishing Report for the third quarter of 2026 (July to September, published on 16 October 2026), Microsoft was the most impersonated brand in phishing, with 33% of all brand phishing attempts, up from 23% in the second quarter. Apple and Google followed with 8% each, then LinkedIn with 6%, with Amazon in fifth place (Check Point). Technology was the most impersonated sector, followed by social networks and banking.

Rankings of the most impersonated brands differ by source, because each company counts something different in its own data. Below, every list names its report, its period and what it measures. We have not merged lists or filled gaps with estimates. For broader phishing numbers, see phishing statistics 2026.

Most impersonated brands in Q3 2026

Check Point Research's Q3 2026 ranking, as given in the text of the report:

Check Point also says YouTube rose five places to sixth and Dropbox climbed ten places to eighth. The text gives no shares below fourth place, so we leave them out. It describes Microsoft's share as roughly four times that of any other brand and links this to what the credentials unlock: a Microsoft login can open a whole corporate environment, while many other top brands lead mainly to personal accounts.

Campaigns highlighted in the report included a fake payment-failure email using the name of the AI assistant Claude, a fake Google Antigravity download site with a malicious install command, and spoofed Docusign pages that pushed a remote management tool onto victims' devices.

How the ranking changed from Q4 2025 to Q3 2026

Two patterns hold across all four quarters. Microsoft is first every time, and almost every brand in the top five is a technology or social platform whose login opens email, files, contacts or payments. The sector order was the same in Q1, Q2 and Q3 2026: technology first, then social networks, then banking. Brands outside technology appear lower and move around more: in Q4 2025, for example, PayPal, Adobe and Booking each had 2% and DHL 1%.

A third pattern is newcomers. ChatGPT entered Check Point's top ten for the first time in Q2 2026, and the Q3 report described lures using Claude and Google Antigravity. Attackers follow the services people have recently started paying for or installing. A product that bills customers every month gives an easy "payment failed" pretext, and a new developer tool gives a reason to paste an install command.

Other reputable rankings

• Guardio, Q2 2026 (April to June): based on detections among users of its consumer security product, Guardio ranked Microsoft, Steam, Netflix, WhatsApp, Xfinity, Yahoo, Facebook/Meta, Ledger, Coinbase and Amazon as the ten most imitated brands, without percentages (Guardio). The consumer angle explains why gaming, streaming and crypto brands rank higher than in Check Point's list.
• APWG, Q2 2026: APWG reports sectors rather than brands. Its member Crane Authentication found SaaS and webmail to be the most attacked category at 29.1% of attacks, followed by payment services at 13.2%, financial institutions at 11.4% and logistics and shipping at 9.6% (APWG).
• Kaspersky, 2025: Kaspersky reported 801,148 Netflix-themed and 576,873 Spotify-related phishing attempts in 2025, and 2,054,336 attempts impersonating gaming platforms such as Steam, PlayStation and Xbox (Kaspersky). These are counts of attempts its products detected, not a ranking.

Your brand does not need to be on the list

Top-ten lists hide how wide phishing really is. APWG's Q2 2026 report identified 941 unique brands targeted during the quarter, and half of them were attacked five times or less. APWG notes that phishers keep building page templates for lesser-known and regional targets. A regional bank, a parcel company or a SaaS product can be a steady target without ever appearing in a headline ranking; our article on SaaS login page phishing covers that case.

The patterns are the same for small and large brands: a lookalike domain, a cloned login or payment page, a lure by email, SMS or ads, and often a fake support account. Our guide to brand impersonation protection sets out the controls for each channel.

How to read brand phishing rankings

• Check what is counted. Check Point reports each brand's share of the brand phishing attempts in its data, Guardio ranks brands by detections among its users, and APWG reports sectors. These cannot be combined into one list.
• Mind the denominator. A 33% share means a third of the brand phishing attempts one vendor detected, not a third of all phishing everywhere.
• Check the period. Quarterly lists move with seasonal events such as holiday shopping. Quote the quarter, not just the year.
• Look for the method. Vendor reports often say little about how attempts are detected or classified. Treat exact places below the top few with caution.
• Skip unsourced lists. If a ranking names no report and period, do not repeat it.

If your own brand is being copied, the figures that matter most are yours: how many fake sites and domains are live, and how quickly they come down. Phishvoid finds and removes sites that impersonate your brand, with a human team verifying each one before it is reported.

FAQ

What is the most impersonated brand in phishing?

Microsoft, in every quarterly Check Point Research ranking from Q4 2025 to Q3 2026. In Q3 2026 it accounted for 33% of the brand phishing attempts in Check Point's data.

Which industry is impersonated most?

Check Point found technology to be the most impersonated sector in Q3 2026, followed by social networks and banking. APWG's Q2 2026 report, which uses different categories, put SaaS and webmail first at 29.1% of attacks.

Why do different reports list different brands?

Each company sees a different slice of traffic. A business security vendor sees more workplace lures, while a consumer security product sees more gaming, streaming and crypto scams. Detection methods and categories also differ.

Are banks among the most impersonated brands?

Banking was the third most impersonated sector in Check Point's Q3 2026 report, and financial institutions accounted for 11.4% of attacks in APWG's Q2 2026 data. Individual banks rarely reach global top-ten lists, partly because each serves a narrower customer base, so a bank's own exposure is better measured directly. See brand protection for banks.

How often are these rankings published?

Check Point publishes its Brand Phishing Report every quarter, and APWG publishes its Phishing Activity Trends Report quarterly as well. Guardio has also published quarterly brand rankings.