Microsoft was the Most Impersonated Brand in Q2, 2023

Microsoft was the most impersonated brand in phishing attacks during Q2, 2023, according to Check Point’s latest Brand Phishing Report.

“Last quarter global technology company Microsoft climbed up the rankings, moving from third place in Q1 2023 to top spot in Q2,” the researchers write. “The tech giant accounted for 29% of all brand phishing attempts. This may be partially explained by a phishing campaign that saw hackers targeting account holders with fraudulent messaging regarding unusual activity on their account. Our report ranked Google in second place, accounting for 19% of all attempts and Apple in third, featuring in 5% of all phishing events during the last quarter. In terms of industry, the technology sector was the most impersonated, followed by banking and social media networks.”

Check Point describes a recent phishing campaign that attempted to steal users’ Microsoft login credentials.

“In the second quarter of 2023, a phishing campaign targeted Microsoft account holders by sending fraudulent messages regarding unusual sign-in activity,” the researchers write. “The campaign involved deceptive emails which were sent allegedly from inside the company with sender names such as “Microsoft on <company domain>”. The subject line of these phishing emails was “RE: Microsoft account unusual sign-in activity” and they claimed to have detected unusual sign-in activity on the recipient’s Microsoft account. The emails provided details of the alleged sign-in, such as the country/region, IP address, date, platform, and browser. To address this supposed security concern, the phishing emails urged recipients to review their recent activity by clicking on a provided link which leads to malicious websites unrelated to Microsoft.”

Another phishing campaign impersonated Wells Fargo in order to steal bank account information. The phishing emails had the subject line ‘Verification Required’ and aimed to trick recipients into providing their account information by claiming that certain details were missing or incorrect.

New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for phishing and other social engineering attacks.