PhishPin / Brands Live Phishing Data / Business software & payroll
Business software & payroll phishing: which brands are copied the most
18 business software & payroll brands are tracked in PhishPin's index. Together they have 55 hostnames in phishing feeds and 35 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated business software & payroll
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | HubSpot | 55% | 37 · Elevated | 30 | 5 |
| 2 | ServiceNow | 13% | 23 · Moderate | 7 | 2 |
| 3 | ADP | 7% | 17 · Moderate | 4 | 1 |
| 4 | Naukri | 5% | 22 · Moderate | 3 | 6 |
| 5 | Workday | 4% | 16 · Moderate | 2 | 3 |
| 6 | Fiverr | 4% | 15 · Moderate | 2 | 2 |
| 7 | Upwork | 4% | 15 · Moderate | 2 | 2 |
| 8 | Smartsheet | 4% | 13 · Low | 2 | 1 |
| 9 | Indeed | 2% | 13 · Low | 1 | 3 |
| 10 | MYOB | 2% | 12 · Low | 1 | 2 |
| 11 | Calendly | 2% | 9 · Low | 1 | 1 |
| 12 | Gusto | 0% | 8 · Low | 0 | 3 |
| 13 | Glassdoor | 0% | 6 · Low | 0 | 2 |
| 14 | SAP Concur | 0% | 4 · Low | 0 | 1 |
| 15 | Xero | 0% | 4 · Low | 0 | 1 |
| 16 | Mailchimp | 0% | 0 · Low | 0 | 0 |
| 17 | Paychex | 0% | 0 · Low | 0 | 0 |
| 18 | Rippling | 0% | 0 · Low | 0 | 0 |
Common lures against business software & payroll
- A payroll or HR notice asking employees to "re-verify direct deposit details".
- A shared-file or invoice link that leads to a fake single sign-on page.
- A licence-expiry or security-patch email aimed at administrators.
- An e-signature or expense-report request from a spoofed manager.
Red flags
- Direct-deposit or bank-detail changes requested by email are a classic payroll-diversion trick.
- The sign-in page is not your company's single sign-on or the vendor's official domain.
- The request comes from a manager or vendor outside normal channels.
If you already clicked or entered details
Tell your IT/security team straight away, reset the password and revoke active sessions, check for forwarding rules and changed payroll details, and enable phishing-resistant MFA for administrators.
Is your business software provider being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which business software & payroll brands are impersonated the most?
HubSpot leads with 30 hostnames in phishing feeds, followed by ServiceNow (7) as of 1 Nov 2026.
How can I spot phishing that targets business software & payroll?
Direct-deposit or bank-detail changes requested by email are a classic payroll-diversion trick. The sign-in page is not your company's single sign-on or the vendor's official domain. The request comes from a manager or vendor outside normal channels.
What should I do if I fall for a fake business software provider page?
Tell your IT/security team straight away, reset the password and revoke active sessions, check for forwarding rules and changed payroll details, and enable phishing-resistant MFA for administrators.