OpenAI’s ChatGPT has made its debut among the top 10 most impersonated brands in phishing attacks during the second quarter of 2026, marking a significant shift in cybercriminal targeting patterns. According to research published by Check Point, the popular AI tool’s growing user base has made it an attractive target for scammers seeking to exploit trust in emerging technology platforms.
How Are Attackers Impersonating ChatGPT?
Check Point researchers observed a fake “ChatGPT Plus payment failed” email campaign in June 2026 that exemplified the new threat. The malicious messages were designed to perfectly mimic OpenAI billing notices, directing victims to fraudulent pages specifically built to harvest complete credit card details. The cybersecurity firm warned that ChatGPT’s inclusion in the top 10 represents “a strong signal of where attacker attention is heading next.”
As AI tools transition from novelty to essential daily utilities for millions managing subscriptions, payments and work tasks, they become equally attractive targets as traditional banks or technology giants. Check Point predicts AI platforms will continue climbing phishing impersonation rankings in future quarters.
Which Brands Remain Most Targeted?
Check Point’s Q2 Brand Phishing Report revealed that Microsoft retained its position as the most impersonated brand, accounting for 23% of all phishing attempts during the quarter. This represents nearly double the share of LinkedIn, which held second place and is also owned by Microsoft. Google, Apple and Amazon rounded out the top five, with these brands collectively accounting for over half of all phishing attempts observed.
Technology emerged as the most targeted industry overall, followed by social networks and banking sectors. Brand phishing operations involve scammers impersonating trusted, well-known companies through email, fake websites or both to steal login credentials, payment details or personal information.
What Real-World Cases Were Discovered?
Beyond the ChatGPT campaign, Check Point documented diverse phishing tactics during Q2 2026. These included a cloned Michael Kors store replicating the entire checkout process, a fake UNIQLO storefront operating in a country where the brand doesn’t exist, and a fraudulent PayPal login page featuring a distorted logo that appeared AI-generated. Scams ranged from fake payment failure notifications to complete replica online stores, counterfeit login pages and malware disguised as software updates.
What Mitigation Steps Are Recommended?
In a blog published on July 23, Check Point outlined recommendations for combating brand phishing threats. These include stopping phishing messages before they reach inboxes rather than relying on post-delivery detection, using AI-powered detection to identify brand impersonation, business email compromise, credential harvesting, QR code phishing and AI-generated attacks with accuracy exceeding manual review capabilities. Organizations should consolidate email and workspace protection across Microsoft 365, Google Workspace and collaboration tools into unified platforms while automating investigation and response processes to enable security teams to resolve genuine threats faster.
Source: Infosecurity Magazine