Check Point Research (CPR), the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), has released its Brand Phishing Ranking for Q2 2025. The report identifies the brands most frequently impersonated by cybercriminals to steal sensitive personal and financial data.

According to the report, Microsoft remained the most targeted brand in phishing attempts, appearing in 25% of all attacks. Google followed with 11%, and Apple ranked third at 9%. Notably, Spotify returned to the top 10 list for the first time since Q4 2019, ranking fourth with 6% of phishing activity.

Check Point revealed that the Technology sector continued to be the most impersonated industry. It was followed by Social Networks and Retail.

Omer Dembinsky, Data Research Manager at Check Point Software, stated that cybercriminals are exploiting trust in well-known brands. He added that the rise in Spotify impersonation and the surge in travel-related scams reflect how phishing campaigns adapt to seasonal trends and user behavior.

Key findings from the Q2 2025 report include:

Microsoft, Google, and Apple were the top three phishing targets.

Spotify phishing scams marked the platform’s return to the rankings.

A 1000% increase was seen in Booking.com-themed phishing domains.

Check Point also reported a significant phishing campaign targeting Spotify users. The malicious login page, hosted on a deceptive domain, mimicked the official Spotify login. After users entered their credentials, they were redirected to a fake payment page designed to steal credit card information.

Another major trend was the spike in Booking.com-related phishing domains. Over 700 domains used the format confirmation-id****.com. Many included real user data to increase credibility and urgency.

Check Point noted that although these domains were often short-lived, they highlighted the growing sophistication of phishing techniques.

The Brand Phishing Ranking is based on data from Check Point’s ThreatCloud AI platform, which analyzes phishing emails, fake websites, and impersonation attempts across various vectors.

Related post

View all