Hackers disguise phishing as promising business opportunities
Fortra tracked a twelvefold rise in RFQ phishing that steals business credentials, MFA data, and sessions.
Fortra researcher Cadence Riddle reported a 12-fold increase in malicious emails mentioning requests for quotation between October 2025 and September 2026. Nearly 73 percent led to pages built to steal business login credentials, often imitating Microsoft 365 or Google Workspace, and some kits also sought MFA approvals, one-time codes, cookies, or session tokens. The messages came from 664 sender domains and typically followed a short inquiry with a link posing as drawings, an RFQ package, or a procurement portal. A compromised mailbox can then expose invoices and project data or be used for payment-redirection fraud.
- Fortra saw RFQ-themed malicious email rise twelvefold from October 2025 to September 2026.
- About 73 percent of lures led to credential-theft pages; some also captured MFA or session data.
- Messages came from 664 sender domains and mainly targeted sales and procurement staff.
- Compromised mailboxes can enable invoice fraud, payment redirection, and further phishing.
Full article509 words · extracted from helpnetsecurity.com · click to collapse
Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week.
Cadence Riddle, a cybersecurity researcher at Fortra, tracked a 12-fold increase in malicious emails mentioning “RFQ” (request for quotation) between October 2025 and September 2026. In nearly 73% of cases, the lure led to a page built to steal login credentials.
“RFQ communication is routine for sales, procurement, and customer-facing teams in many organizations. A short request for availability or a promise to send project specifications can appear credible, especially when it is framed as a potential business opportunity. Once the recipient responds however, the attacker typically introduces an external link designed to collect business credentials, MFA information, or session data,” Riddle explained.
The opening email usually says very little, Riddle found. It may name a purchasing manager, procurement specialist or company representative and ask the recipient to confirm availability or send a quote, while offering almost no detail about the project itself.
After a reply comes in, the attacker follows up with a link described as project drawings, an RFQ package, a secure file transfer or a procurement portal. The page behind it typically imitates a Microsoft 365, Google Workspace or similar business sign-in, and depending on the phishing kit used, it may also try to capture MFA approvals, one-time passcodes, cookies or session tokens. A smaller share of the emails delivered malware.
The business framing does part of the work for the attackers. The RFQ context “may lower a recipient’s suspicion when they encounter a login prompt,” Riddle wrote.
The messages came from 664 different sender domains. Riddle believes these may include disposable domains, webmail accounts, compromised legitimate accounts and domains chosen to resemble existing companies.
“The broad sender-domain footprint means that sender reputation and blocklists remain useful, but cannot be the sole basis for detection,” he added.
A trusted account in the wrong hands
An attacker who gets into a business mailbox can search it for customer information, invoices, payment instructions, internal contacts and details of ongoing projects. The account can then be used to send phishing emails to coworkers, customers and suppliers who have every reason to trust the sender.
Payment-redirection fraud, invoice manipulation, fraudulent purchase requests and exposure of customer and project data are among the possible consequences Riddle lists, along with damage to the victim company’s reputation.
“Even when no direct financial loss occurs, an incident can disrupt normal business communication, consume investigation resources, and reduce confidence in the organization’s security practices,” noted Riddle.
Sales, procurement and customer-facing employees are the most exposed, since their jobs involve opening documents and links from people they have never dealt with. Banning links for those teams isn’t practical, researcher notes, so they need a safe way to check prospective buyers and suspicious material.
“By treating the RFQ process as a targeted abuse case with clear controls and owners, organizations can reduce the likelihood that a routine business inquiry becomes an account-compromise incident,” concluded Riddle.