ChatGPT ranks among top 10 most impersonated brands in phishing campaigns
ChatGPT has entered the top 10 most impersonated brands in phishing attacks, with cybercriminals launching campaigns that exploit growing employee familiarity with generative AI to capture credentials and payment information. Researchers found that generative AI is enabling attackers to create more convincing and rapidly-varying phishing campaigns at scale.
What happened
ChatGPT appeared among the world's top 10 most impersonated brands for the first time in Check Point Research's Q2 2026 Brand Phishing Report, accounting for 1.1% of all brand phishing attempts and ranking tenth globally.
Cybercriminals launched phishing campaigns impersonating ChatGPT Plus through fake subscription payment failure emails, redirecting victims to convincing payment pages designed to capture credit card information.
Reported impact
Attackers are exploiting growing employee familiarity with AI platforms to target enterprises through credential theft, payment fraud and data compromise.
Generative AI is enabling threat actors to create more credible emails and cloned websites at scale, with attackers using AI to produce faster, more scalable phishing campaigns with unique variations of messages.
Index analysis
The inclusion of ChatGPT in the top 10 most impersonated brands reflects rapid adoption of generative AI across enterprises and represents a shift in the attack surface as employees increasingly log into AI platforms and share business information through conversational interfaces.
Security teams face challenges as polymorphic phishing campaigns now create unique versions of messages by changing URLs, sender information and subject lines, with indicators of compromise becoming increasingly short-lived.
Governance controls
Check Point Research recommended organizations shift from reacting after compromise to preventing threats before users engage with them, as organizations integrate AI into business processes and employees rely on AI assistants for business decisions.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.