Microsoft is the brand with the most phishing attacks

Check Point Research (CPR) , the Threat Intelligence division of Check Point® Software Technologies Ltd. , a cybersecurity solutions provider, today released its Q4 2025 Brand Phishing Rankings. The latest findings show that Microsoft once again ranked as the most impersonated brand, appearing in 22% of all phishing attempts during the quarter. This continues a multi-quarter trend in which attackers are systematically abusing widely used business and consumer platforms to steal credentials and gain initial access.

Google (13%) and Amazon (9 % ) followed in second and third place respectively, with Amazon ’s rise driven primarily by Black Friday and holiday season activity. After several quarters of absence, Facebook ( Meta ) re-entered the global top ten, taking fifth place, signaling the increased interest of attackers in hacking social media accounts and identity theft.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

Omer Dembinsky , Data Research Manager at Check Point Research , said: “ Phishing campaigns are becoming increasingly sophisticated, leveraging sophisticated graphics, AI- generated content and highly persuasive domain lookalikes . The fact that Microsoft and Google remain top targets shows how valuable identity-based access has become to attackers. At the same time, the return of companies like Facebook and PayPal highlights how cybercriminals are adapting quickly, moving towards platforms where trust and urgency can be exploited. To counter these evolving tactics, organizations must adopt a prevention-first approach that combines AI - powered detection with strong authentication and ongoing user awareness.”

Top 10 Most Counterfeited Brands in Q4 2025:

1. ecosystem - 22%
2. Google - 13%
3. Amazon - 9%
4. Apple  - 8%
5. Facebook (Meta) - 3%
6. PayPal - 2%
7. Adobe - 2%
8. Booking  - 2%
9. DHL - 1%
10. LinkedIn - 1%

The persistent dominance of Microsoft and Google reflects their essential role in identity, productivity, and cloud services — making the related credentials particularly valuable to cybercriminals.

Campaigns Phishing Observed in the Fourth Quarter of 2025

Roblox : Phishing Targets Children and Gamers

In Q4 2025, CPR detected a Roblox -themed phishing campaign , which was observed through users’ browsing activity. The malicious website was hosted on a lookalike domain , robiox [.] com [.] af , which differed from the legitimate roblox . com by a subtle letter substitution.

Roblox Game Page Fraudulent

The landing page featured a fake Roblox game titled “SKIBIDI Steal a Brainrot,” featuring realistic graphics, ratings, and a prominent “Play” button. The content closely mimicked one of the most popular games currently available on the Roblox platform and was clearly designed to appeal to children — a key segment of the platform’s user base.

Roblox Fraudulent Login Page

When users attempted to access the game, they were redirected to a second-stage phishing page that mimicked the official Roblox login interface. Credentials entered on the page were silently stolen, while the user remained on the same screen with no visible sign of compromise.

Netflix: Account Recovery as Bait

Netflix Fraudulent Page

CPR also identified a phishing website mimicking Netflix, hosted at netflix-account-recovery[.]com (currently inactive). The domain was registered in 2025, unlike the legitimate netflix.com, which dates back to 1997.

Netflix Legal Page ( netflix.com/LoginHelp )

The phishing page closely mimicked Netflix 's official login and account recovery interface , prompting users to enter their email address or mobile number and password. The goal was clear: to steal credentials to take over an account, potentially allowing for resale or further fraud.

Facebook ( Meta ): Locally Targeted Credential Theft

Fraudulent Facebook (Meta) Page

In another campaign observed in Q4 2025, CPR detected a Facebook -themed phishing page distributed via email and hosted at facebook – cm [.] github [.] io . The page mimicked the Facebook login portal and was presented entirely in Spanish, using familiar branding , layout, and authentication prompts. Users were prompted to enter their email address , phone number, and password, which were then hijacked by the attackers to allow unauthorized account access and potential further malicious exploitation.

Why the Brand Phishing He continues to succeed.

Brand phishing remains effective because it exploits users’ trust in familiar digital services. Attackers increasingly rely on:

• Similar sectors (Lookalike domains) with subtle character changes.
• Professionally designed pages that mimic real connection processes.
• Multi-stage cheat routes that seem legitimate.
• Emotional stimuli such as urgency, reward, or brand familiarity.

As identity becomes the primary attack surface in today's cloud -based environments , phishing continues to serve as a key initial access vector for both consumer fraud and corporate breaches.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.