Cybercriminals are increasingly shifting their attention to artificial intelligence platforms as AI becomes part of everyday work and online life, with ChatGPT entering the world’s 10 most impersonated brands in phishing attacks for the first time.
The finding comes from Check Point Research’s (CPR) Brand Phishing Ranking for the second quarter of 2026, which tracks the brands most frequently imitated by attackers to steal people’s passwords, payment details and other sensitive information. While Microsoft remained the most impersonated brand, accounting for 22.6% of phishing attempts recorded during the quarter, researchers said the appearance of ChatGPT in the top 10 signals a new phase in online scams.
The report suggests that as more people rely on AI tools for work, study and paid subscriptions, cybercriminals are beginning to treat AI platforms the same way they have long targeted email providers, banks and social media platforms.
Phishing is a type of cyberattack in which criminals disguise themselves as trusted companies to trick people into revealing sensitive information. Victims are often lured through emails, text messages or fake websites that closely resemble legitimate services. Once users enter their login credentials, bank card details or verification codes, the information can be used to access accounts, steal money or commit identity fraud.
For years, attackers have concentrated on widely used brands such as Microsoft, Google, Apple and PayPal because millions of people interact with those services daily. According to the latest ranking, Microsoft remained the most impersonated brand globally, followed by LinkedIn, Google, Apple, Amazon, Adobe, Facebook, WhatsApp, PayPal and ChatGPT.
Together, the five most impersonated brands accounted for more than half of all phishing activity tracked during the quarter, while the technology sector remained the primary target, ahead of social networking platforms and banking services.
Researchers said ChatGPT’s inclusion reflects the growing popularity of AI services rather than a weakness in the platform itself. As more users subscribe to premium AI tools or use them for work, criminals see an opportunity to exploit the trust people place in those services.
One phishing campaign uncovered during the quarter involved fake emails claiming that a user’s ChatGPT Plus subscription payment had failed. Recipients were urged to update their payment information through fraudulent websites designed to capture credit card details.
The report also highlights another way AI is changing cybercrime. While criminals are impersonating AI platforms, they are also using generative AI to produce more convincing phishing emails, cloned websites and fake digital experiences. AI tools can help attackers write messages with fewer spelling mistakes, imitate the tone of legitimate companies and personalise scams at a scale that was previously difficult to achieve.
“Brand phishing is entering a new phase where attackers are not only exploiting trust in household technology names, but also moving quickly toward the AI platforms people are beginning to rely on every day,” said Omer Dembinsky, Data Research Manager at Check Point Research.
He added that as generative AI makes it easier to produce realistic phishing campaigns, organisations need to focus more on preventing attacks before employees interact with fraudulent messages or websites.
Beyond ChatGPT, the report documented several other phishing campaigns discovered during the quarter. These included a counterfeit Apple iCloud login page, a fake Microsoft support website that distributed malicious software disguised as an Office security update, a fraudulent PayPal login page, a fake Michael Kors online store built to steal payment information, and a fake UNIQLO website operating in a country where the retailer has no official presence.
Although phishing tactics continue to evolve, researchers said many scams still share common warning signs. These include unusual web addresses, unexpected requests for passwords or payment details, messages that create a false sense of urgency, broken website features and links that direct users to domains different from the official website.
For everyday users, the report serves as a reminder that the growing popularity of AI services is attracting cybercriminals alongside legitimate users. Security experts recommend verifying website addresses before signing in, enabling multi-factor authentication where available, avoiding links in unsolicited emails or text messages, and accessing online services directly through their official websites or mobile applications instead of clicking embedded links.
The report suggests that as AI becomes more deeply integrated into everyday digital life, it is likely to join email, online banking and social media as another major battleground in the fight against phishing and online fraud.