Open AI’s ChatGPT entered the top 10 of the most impersonated brands in phishing attacks for the first time in the second quarter of 2026, according to a Check Point study.
This included a fake "ChatGPT Plus payment failed" email the cybersecurity company observed in June. The malicious email was dressed up to look exactly like an OpenAI billing notice and led victims to a page built purely to steal full credit card details.
The inclusion of OpenAI’s top customer-focused tool is “a strong signal of where attacker attention is heading next,” said Check Point.
“As AI tools move from novelty to daily habit for millions of people managing subscriptions, payments, and work tasks through them, they become just as attractive a target as any bank or tech giant. Expect AI platforms to keep climbing this list in future quarters.”
Big Tech Organizations: The Most Impersonated Brands
As detailed in Check Point’s Q2 Brand Phishing Report, Microsoft remains the top impersonated brand, , as it did in the previous quarter. It accounts for 23% of all phishing attempts, nearly double the share of LinkedIn, the second-most targeted brand – also owned by Microsoft.
Google, Apple and Amazon also made the top five most impersonated brands, which accounted for over half of all phishing attempts.
Brand phishing is described by Check Point as an operation where a scammer impersonates a trusted, well-known company, through email, a fake website or both, in order to steal login credentials, payment details or personal information.
Real world cases this quarter ranged from fake payment failure emails to full replica online stores, fake login pages and malware disguised as software updates.
How to Prevent Brand Phishing
As the top five most impersonated brands in Q2 2026 suggests, technology was the most targeted industry overall, followed by social networks and banking.
Other real cases in the report included a cloned Michael Kors store that replicates the entire checkout, a fake UNIQLO storefront in a country where it doesn't even operate and a dodgy PayPal login page with a warped logo that looks AI-generated.
In a blog published on July 23, Check Point provided recommendations to mitigate the threat of brand phishing. These include:
- Stopping phishing messages inline before they reach an inbox, rather than relying on detection once the damage is already done
- Using AI powered detection to catch brand impersonation, business email compromise, credential harvesting, QR code phishing and AI generated attacks with a level of accuracy manual review can’t match
- Consolidating email and workspace protection across Microsoft 365, Google Workspace and collaboration tools into a single platform, reducing operational complexity
- Automating investigation and response so security teams can resolve real threats faster
Image credit: Celia Ong / CKA / Shutterstock.com