Microsoft's share of brand phishing climbs to 33% in Check Point's Q3 count

The gain is 10 percentage points in a quarter ^[10], about 43% relative to Q2 ^[11]. Check Point puts Microsoft at roughly four times the share of any other brand ^[2]. Its explanation is access: attackers favor Microsoft because a stolen login can open up a company's whole environment, from email to files to collaboration tools, where most of the other top brands mainly get an attacker into personal accounts ^[13].

The Q3 examples sort into two kinds of lure. The Claude email is a payment lure. Its "Update payment method" button leads into a fraudulent payment update process that puts financial details and account credentials at risk ^[6].

The Antigravity page is a code-execution lure. The visitor sees a Linux command that looks like an installer. It decodes a Base64 string, downloads a shell script from an external server and executes it, and Check Point describes the result as remote code execution on the victim's system ^[7].

Check Point says the Apple page imitates the official site so closely that users may assume its advice is genuine ^[9]. In our view the cheapest control is a plain rule for staff: no terminal command from a web article, whatever the branding. On the endpoint, the Antigravity chain would show a Base64 decode feeding a shell and a download from an outside host. That pattern is worth a detection rule.

Check Point reports shares of the attempts it tracked ^[1]; the blog excerpt does not include total volumes. The summary also says attackers persuade victims to install remote access software ^[14]. The examples in the excerpt are payment and terminal-command lures.