Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation

In Q3 2026, Microsoft was the most impersonated brand in phishing attacks, accounting for 33% of all brand impersonation attempts tracked by Check Point Research, up from 23% in Q2. Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, while many of the other top brands mainly lead to personal accounts. Apple, Google, LinkedIn and Amazon completed the top five, and together these brands made up more than half of all attempts, showing how heavily attackers lean on a small group of trusted names. This quarter also brought examples showing […]

The post Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/5wEXe9I
via

Securing AI Agents from Discovery to Runtime: Check Point on Google Cloud’s Gemini Enterprise

AI agents are moving into production fast. They read enterprise data, call tools, and take actions across business systems. That creates a new problem: an agent can be fully authenticated and authorized and still be manipulated into doing the wrong thing. Google Cloud’s Gemini Enterprise gives enterprises a central control plane for agents. Check Point extends that control plane with AI-specific risk assessment and real-time, context-aware protection. This post details where Check Point integrates and what it looks like for a security team. Google Cloud’s direction with agent orchestration, registries, and gateway layers signals a clear design pattern: centralized AI […]

The post Securing AI Agents from Discovery to Runtime: Check Point on Google Cloud’s Gemini Enterprise appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/Z7cqTA0
via

Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign

A calendar invite is one of the most routine messages in the modern workplace. It lands in the inbox, asks for a few seconds of attention, and is rarely questioned. Attackers know this, and they are now using fake meeting invitations to steal Microsoft account credentials. We have identified several large-scale phishing campaigns that abuse fake calendar invites to harvest credentials. Some arrive as an .ics attachment (example 1). The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting a software vulnerability. Others use a link that appears to lead to a different […]

The post Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/01ySJPo
via

Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages

A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate. Yet the phishing site may still be there. Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. Starting with a handful of phishing URLs, the investigation identified a repeatable technical fingerprint that ultimately connected the activity to thousands of rotating domains targeting organizations and users across multiple regions. The infrastructure uses regional paths, localization, session controls, and token gated access to determine […]

The post Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/2BJVzWF
via

Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For

Key takeaways In the past year, 78 percent of organizations reported a confirmed or suspected AI-related security incident, according to Check Point’s 2026 Cloud Security Report. →No attacker required. Agents plan their own steps, and an agent trying to help can take one nobody asked for that deletes data, leaks it or widens someone’s access →Permissions and prompt screening miss the action itself. Least privilege cannot take away access the job needs, and prompt attack detection screens what goes into the agent, not what it is about to do →Dangerous Deviation Detection checks each tool call before it runs. It […]

The post Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/5fxm81I
via

Election Scams Are Getting Harder to Spot as Real Campaign Outreach and Fraud Converge

In September, viewers of a Pennsylvania TV station received a text telling them to “verify your voter profile.” The station’s investigator could not find out who sent it, and the link was flagged as malware. When Check Point Exposure Management researchers followed the link, it led to a political fundraising page. That small episode sums up the main finding of our report on 2026 US midterm election threats. Voters are having a hard time telling which messages are real, and attackers benefit from that doubt. Real outreach and fake outreach look alike Between July and September, election offices in Rhode […]

The post Election Scams Are Getting Harder to Spot as Real Campaign Outreach and Fraud Converge appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/Mu1D3re
via

Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways

Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications. Key Takeaways Check Point Research discovered two high risk vulnerabilities in LiteLLM, tracked as CVE-2026-35029 and CVE-2026-59823. CVE-2026-35029 allowed any user, including those with read only access, to reach administrative functions and take over the gateway. CVE-2026-59823 allowed attackers to redirect […]

The post Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/QCajYhi
via