For years, the anti-phishing playbook has been drilled into office workers like a fire-safety briefing: check the sender, hover before you click, never type your password into a page you reached from an email. The latest data from Check Point Research suggests attackers have read the same briefing. Increasingly, they are not after your password at all. They want you to open a terminal and paste in their code yourself.
The Nasdaq-listed cybersecurity company’s Brand Phishing Ranking for Q3 2026, released on Wednesday, shows Microsoft remained the most impersonated brand, accounting for 33 per cent of all brand phishing attempts tracked in the quarter, up from 23 per cent in Q2. Apple climbed two places to second with 8 per cent, level with Google in third. LinkedIn slipped two places to fourth at 6 per cent, and Amazon rounded out the top five at 4 per cent.
Also Read: Singapore’s cybersecurity paradox: Leading in digital, lagging in defense
Those five names account for more than half of all impersonation attempts, and Microsoft’s share alone is roughly four times that of any other brand. The logic is not hard to follow. A single Microsoft 365 login unlocks email, cloud storage, Teams chats and often the company’s single sign-on, so one stolen credential works as a skeleton key to the whole office.
What the release does not explain is why Microsoft’s share jumped ten percentage points in a single quarter, or how many attempts the ranking is built on. Without that denominator, the percentages are best read as a direction of travel rather than a census.
From stealing passwords to borrowing your hands
The more interesting part of the report sits below the league table. In Q3, Check Point says, attackers followed users into AI and developer tools, and several campaigns stopped bothering with credential theft altogether.
One impersonated Claude, Anthropic’s AI assistant, with a fake payment-failure email claiming a EUR500 (about US$580) charge had been declined. The message warned that API access and Claude seats would be paused unless the recipient updated their payment details, a lure aimed squarely at whoever holds both the company card and the API keys.
Another used a lookalike website for Google Antigravity, Google’s AI-powered coding environment, which displayed what looked like a routine Linux installation command. The command actually decoded a Base64-encoded instruction (Base64 turns text into an unreadable string of characters, which conveniently makes malicious code look like harmless gibberish) that downloaded and ran a shell script from an external server. The result was remote code execution: the attacker could run commands on the victim’s machine at will.
A fake Apple support article coaxed Mac users into running terminal commands with the promise of better performance. And a spoofed Docusign page told visitors a reader update was needed before they could view a document. Clicking Continue downloaded FleetDeck, a legitimate remote monitoring and management tool that IT teams use to administer devices, and which an intruder can use just as easily.
None of these campaigns exploits a software flaw. The victim does the installing. That is the point: security software trained to flag malware has little reason to stop a genuine remote-access tool, and a developer who pastes an install command from a web page is doing something the industry has spent years normalising.
Also Read: Southeast Asian SMEs remain soft targets as ransomware groups refine extortion tactics
“Brand phishing is entering a new phase,” said Omer Dembinsky, Data Research Manager at Check Point Research. Attackers, he added, are “moving beyond password theft to convince victims to run malicious commands or install remote access software themselves.”
Why this lands differently in Southeast Asia
The shift matters for a region whose startups run lean. In a 15-person company in Jakarta or Ho Chi Minh City, there is often no finance team between a billing alert and the person who pays it, and the engineer installing a new AI coding tool may also be the only one who would notice it misbehaving. Speed and informality, the traits founders prize, are exactly what these lures exploit.
Regional data points the same way. A Mimecast study published in July found 65 per cent of IT and security decision-makers surveyed in Singapore and Australia expected an AI-enabled attack on their organisation within 12 months, while 60 per cent said they were not fully prepared for AI-driven threats that exploit human weaknesses. Lean SMEs, often without a dedicated security hire, sit at the soft end of that gap.
Policymakers are busy, but mostly on the consumer front. Singapore has tightened scam rules for messaging, social media and e-commerce platforms, wants Google’s AI to flag scammers before victims transfer money, and its police worked with Meta to disrupt 3.7 million scam-linked assets on Facebook and Instagram, after authorities earlier knocked out 30,000 iMessage accounts tied to scams.
Those efforts target the channels where ordinary people lose their savings. A fake API bill in a developer’s inbox, or a poisoned install command on a cloned product page, falls largely outside them and lands on companies’ own defences instead. Add the rise of deepfake fraud, and the weak point looks less like the software than the moment a busy person decides to trust a familiar logo.
The fix, according to the firm that sells it
Check Point’s prescription is to stop phishing before it reaches inboxes, use AI-powered detection for brand impersonation and credential harvesting, automate investigation and response, monitor for unapproved remote management tools, and scan the wider web for lookalike domains and cloned login pages so they can be taken down. All sensible, and all, unsurprisingly, categories Check Point sells into.
Also Read: Ransomware in Singapore is becoming a human problem, not just a malware one
For smaller teams without an enterprise security budget, some of the most effective controls cost nothing. Billing problems can be handled only by logging into the vendor’s console directly, never through an emailed link. Developer tools can be installed only from documentation reached by typing the address yourself. And a short list of approved remote-access software makes anything else stand out.
Generative AI, Dembinsky warned, is making convincing emails and cloned websites cheap to produce at scale. The uncomfortable corollary is that the next breach at a regional startup may not need to break anything. It will just need someone to copy, paste and press Enter.
The post Phishers now want you to type the malware in yourself appeared first on e27.