ChatGPT enters top 10 most impersonated brands as Microsoft dominates phishing attacks at 23%

ChatGPT Emerges Among Most Impersonated Brands

ChatGPT has made its first appearance in the top 10 most impersonated brands, signaling a notable shift in how cybercriminals target trusted platforms. According to Check Point Research's Brand Phishing Ranking for Q2 2026, OpenAI's flagship AI tool now accounts for 1.1% of all tracked brand phishing attempts 1

1

2

2

. This marks a clear signal that AI platforms are now firmly on cybercriminals' radar as they become integral to daily workflows for subscriptions, payments and workplace tasks. The appearance of ChatGPT alongside established technology giants reflects how attackers are moving quickly toward the AI platforms people are beginning to rely on every day.

Microsoft Maintains Dominance in Phishing Attacks

Microsoft continues to remain the most impersonated brand, accounting for 23% of all brand phishing attempts during Q2 2026—nearly double the next closest brand 2

2

3

3

. When combined with its LinkedIn subsidiary at 11.6%, Microsoft-related platforms account for 34.2% of all tracked brand impersonations 1

1

. The top five most impersonated brands—Microsoft, LinkedIn, Google at 6.7%, Apple at 5.8%, and Amazon at 5.2%—accounted for more than half of all brand phishing activity tracked this quarter. This concentration underscores how attackers focus on a small group of globally recognized platforms that people use and trust every day, exploiting that trust to steal credentials, payment details and personal information.

Fake ChatGPT Plus Subscription Schemes Target Users

One prominent phishing campaign impersonated ChatGPT Plus through a fake subscription payment failure email that copied OpenAI's branding but directed victims to a fraudulent payment page designed to maliciously collect their payment information 1

1

3

3

. The campaign led victims to a page designed to steal full credit card details under the guise of resolving a billing issue. Similarly, attackers created fake Microsoft support pages that warned customers they needed to update Office for security fixes, but the download actually installed malware on victim devices. Other documented campaigns included a near-identical PayPal login page with a distorted logo that may indicate the use of AI-generated assets, and fake Apple iCloud login pages using Apple's logo and branding.

Generative AI Amplifies Threat Sophistication

Generative AI is changing the economics of brand phishing by helping attackers produce more convincing emails and fraudulent websites at scale, making both the volume and sophistication of these attacks likely to grow 2

2

3

3

. Omer Dembinsky, Data Research Manager at Check Point Research, noted that "brand phishing is entering a new phase where attackers are not only exploiting trust in household technology names, but also moving quickly toward the AI platforms people are beginning to rely on every day." As generative AI enables criminals to create more credible emails, cloned websites and fake digital experiences at scale, the barrier to launching sophisticated phishing campaigns continues to lower. The irony is that OpenAI's own AI tools, among plenty of others, likely helped attackers write many of these attacks at lightning pace 1

1

.

Cybercriminals Target Trusted Brands Across Industries

By industry, technology remained the most impersonated sector, followed by social networks and banking, reflecting attackers' continued focus on platforms that hold users' identities, professional relationships and money 2

2

3

3

. ChatGPT sees a similar number of attacks to PayPal at 1.3%, WhatsApp at 1.4%, and Facebook at 1.9% 1

1

. Brand phishing works because it transfers trust from a familiar organization to a fraudulent message or website. Across Q2 2026 cases, attackers used urgency, realistic branding, lookalike domains, broken buttons, mismatched links and subtle visual flaws to lower user suspicion and drive faster action.

Threat Prevention Requires Proactive Cybersecurity Measures

As AI-driven cyber threats become harder to detect and easier to scale, organizations must shift from reacting after compromise to preventing these threats before users ever engage with them, according to Dembinsky 2

2

. Security experts warn potential victims to be wary of clicking on unknown URLs and opening unexpected communications. Basic cybersecurity hygiene can prevent many attacks, including protecting accounts with passkeys and secure multi-factor authentication 1

1

. With trust becoming the primary target and generative AI lowering barriers to creating convincing fake websites, emails and digital experiences, organizations must assume these attacks will continue to grow in both volume and sophistication. Watching for subtle indicators like disconnected social media icons, non-functional buttons, and mismatched domains can help users identify fraudulent sites before sharing sensitive information.