Microsoft tops brand impersonation in Q3 2026 phishing campaigns targeting corporate credentials

1. Executive summary

Check Point Research tracked brand impersonation across the third quarter of 2026 and found Microsoft impersonated in 33% of attempts, up from 23% the previous quarter and roughly four times the share of any other brand. Apple and Google followed at 8% each. The campaigns target corporate credentials because a stolen Microsoft account reaches email, files and collaboration tools, while most other impersonated brands lead only to personal accounts. No CVE, malware family or named threat actor is attached to this reporting, so the risk to EMEA financial services is credential theft and unauthorised access through phishing rather than exploitation of a specific vulnerability. The technical detail is thin: the report gives campaign narratives and one named tool (FleetDeck) but no hashes, domains or IP addresses.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The reporting describes several distinct lures rather than one campaign. The confirmed pattern across them is a branded email or a lookalike website that persuades the recipient to hand over credentials, payment details, or code execution on their own device.

1. A phishing email impersonates Anthropic and Claude branding, claims a €500 payment was declined, and carries the subject line "Payment failed for your Claude account". It warns that API access and Claude seats will be paused unless the payment method is updated. An "Update payment method" button leads to a process that collects payment details and account credentials. Check Point dates this example to October 2026, after the July to September reporting period.
2. A website impersonating Google Antigravity, Google's agentic software development platform, was registered in September. It displayed a Linux installation command that decoded and ran a concealed instruction, which downloaded and executed a script from an external server. That gives the operator code execution on the victim's machine.
3. A website registered in September copied Apple's branding, navigation menus and support content. Visitors were steered to an article titled "Boost your Mac using the terminal", which promised performance improvements to persuade them to run malicious commands.
4. Websites impersonating Docusign appeared in September with further registrations in early October. One showed a document awaiting review and signature behind an "Update Required" prompt claiming a Docusign Reader update was needed. Clicking "Continue" downloaded a FleetDeck installer. FleetDeck is a remote monitoring and management product that can be abused to access devices, and Check Point reads its delivery through a spoofed Docusign site as an attempt to gain unauthorised access to the victim's computer.

The Microsoft share is the headline figure and the one that matters for corporate environments. Check Point's explanation is that stolen Microsoft credentials unlock an entire corporate environment, including email, files and collaboration tools, while many of the other top brands mainly lead to personal accounts. Technology brands were impersonated most often, followed by social networks and banking. Dropbox and YouTube recorded the biggest climbs in the rankings.

The source does not give the domains, URLs, file hashes, installer filenames, or the exact Linux command and external script URL used in the Antigravity lure. It also does not name the operators behind any of these campaigns. Attribution is therefore unconfirmed: no actor is named and none can be matched to a MITRE ATT&CK profile. The whole item rests on a single vendor's quarterly research, so treat the percentages and the campaign descriptions as single-sourced; verify before enforcement.

4. Mitigation & containment

P1 within 24 hours

• Block the FleetDeck installer path at the endpoint and email gateway. FleetDeck is a legitimate RMM product, so allow-list the RMM tools your estate actually uses and alert on any other RMM installer arriving from a browser download. A Docusign-branded page that offers a "Docusign Reader update" is not a legitimate Docusign delivery mechanism; block executable downloads from Docusign-lookalike domains.
• Hunt for FleetDeck installations and for RMM agents that appeared without a change ticket. Isolate any host where an RMM agent was installed from a browser download in the last 60 days.
• Push a user notice covering the four lures in this report: the Claude payment-failure email, the Google Antigravity install command, the Apple "Boost your Mac using the terminal" article, and the Docusign "Update Required" prompt. Tell staff that no vendor asks them to paste a terminal command or install a reader update to open a document.

P2 within 72 hours

• Enforce phishing-resistant MFA (FIDO2 or passkeys) on Microsoft 365 accounts, prioritising finance, treasury and anyone with mailbox delegation. The Microsoft share of impersonation is driven by the value of the account, so credential phishing against Microsoft is the exposure to close first.
• Review conditional access for impossible-travel and new-device sign-ins, and require re-authentication for payment-method changes on any SaaS account that holds a corporate card.
• Add detections for the Antigravity pattern: a Linux shell one-liner that decodes a concealed instruction and pipes to a shell, followed by an outbound fetch of a script from an external host. Alert on curl or wget piped to sh or bash on developer workstations.

P3 within 7 days

• Add the lookalike-brand domains for Anthropic, Claude, Google Antigravity, Apple support and Docusign to DNS and web proxy blocklists as they are identified. The source gives no domains, so this depends on your own telemetry or threat-intel feed.
• Run a tabletop on a FleetDeck-style RMM intrusion: what access would an attacker gain, and how would you detect and evict the agent.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, URLs) are present in the source material. The source describes behaviours and one named tool but gives no machine-pivotable values.

Behavioural indicators

6. Detection

The source gives distinctive strings for the lures but no file artefacts, so the YARA rule targets the phishing page and email content rather than a binary. The Sigma rule targets the Antigravity shell pattern and FleetDeck installation.

rule Phishing_Brand_Impersonation_Lures_2026
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-19"
        reference = "https://www.helpnetsecurity.com/2026/10/19/check-point-brand-impersonation-scams-q3-2026-report/"
        description = "Detects HTML/email content matching brand-impersonation lures reported by Check Point Research Q3 2026"
    strings:
        $claude_subject = "Payment failed for your Claude account" ascii wide nocase
        $claude_button  = "Update payment method" ascii wide nocase
        $apple_article  = "Boost your Mac using the terminal" ascii wide nocase
        $docusign_prompt = "Update Required" ascii wide nocase
        $docusign_reader = "Docusign Reader" ascii wide nocase
    condition:
        2 of them
}

title: Suspicious Shell Pipe and RMM Installer Download
id: 8f3c2a1e-2026-4b7d-9c1a-adversetrace1396
status: experimental
author: Adverse Trace
date: 2026/10/19
references:

  - https://www.helpnetsecurity.com/2026/10/19/check-point-brand-impersonation-scams-q3-2026-report/
description: Detects Linux shell one-liners piping a decoded instruction to a shell and FleetDeck installer downloads consistent with the Antigravity and Docusign lures
logsource:
  category: process_creation
  product: linux
detection:
  selection_pipe:
    CommandLine|contains:

      - '| sh'
      - '| bash'
      - 'base64 -d'
  selection_fetch:
    CommandLine|contains:

      - 'curl'
      - 'wget'
  condition: selection_pipe and selection_fetch
falsepositives:

  - Legitimate install scripts from trusted vendors
level: medium

7. Sources

• Help Net Security, "Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks", https://www.helpnetsecurity.com/2026/10/19/check-point-brand-impersonation-scams-q3-2026-report/, 2026-10-19. Reporting on Check Point Research Q3 2026 brand impersonation data. Single source for all figures and campaign descriptions in this advisory.

8. Adverse Trace position

Adverse Trace assesses this as a moderate, non-CVE credential-phishing advisory. There is no exploitable vulnerability, no named actor and no atomic indicators, so the severity rests on the Microsoft credential-theft exposure rather than on any technical flaw. The 33% Microsoft share, up from 23%, is the number that should drive action for EMEA financial services clients, because a phished Microsoft account reaches email, files and collaboration tools. The campaign descriptions are single-sourced to Check Point Research and carry no domains or hashes, so we will not publish enforcement-grade indicators from them. We will monitor for follow-on reporting that names the lookalike domains or the FleetDeck installer hashes, and we will update this advisory if those appear. Clients should treat the four lures in section 3 as the current phishing themes and prioritise phishing-resistant MFA on Microsoft 365.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.