ChatGPT joins the most impersonated brands in phishing attacks

Microsoft continued to be the most impersonated brand in Q2 2026, accounting for 23% of all brand phishing attempts. LinkedIn, Google, Apple, and Amazon followed, with the five brands together making up more than half of all brand phishing attempts tracked during the quarter, according to Check Point’s Q2 2026 Brand Phishing Report.

Fake ChatGPT Plus billing email (Source: Check Point)

Technology remains the top target, but…

Brand phishing exploits trusted brands people recognise and use every day.

According to Check Point, technology remained the most impersonated sector, followed by social networks and banking. These industries handle users’ identities, finances, and professional relationships, making them valuable targets for attackers and the accounts people would be quickest to protect if they knew an attack was underway.

ChatGPT entered the list of the 10 most impersonated brands for the first time, and Check Point says that we should expect AI platforms to keep climbing the list in future quarters.

“As AI tools move from novelty to daily habit for millions of people managing subscriptions, payments, and work tasks through them, they become just as attractive a target as any bank or tech giant,” the company noted.

Recognizing phishing

Phishing campaigns documented this quarter targeted both consumers and organizations. Attackers impersonate familiar companies through email, fake websites, or both to steal login credentials, payment details, and personal information.

But there are usually tell-tale signs that can help users identify phishing pages and emails: distorted logos, buttons and links that don’t work, domains that don’t match or are obviously not related to the impersonated brand, spelling errors.

Some of these things can be spotted immediately, while finding others requires users to do a more thorough review. One of the things that should push users to engage in the latter are emails that trigger a sense of urgency.

“Payment failures, security alerts, and required updates all push you to act before you stop to think, which is exactly the point,” Check Point said, and pointed out that as attackers increasingly use AI tools to create logos and webpages, “subtle distortions and inconsistencies are becoming reliable indicators that a site is fraudulent.”