RFQ Emails Used to Trick Staff Into Login Theft

Researchers observed a surge in short "request for quotation" (RFQ) emails that look like routine business inquiries to sales and procurement teams. After the victim replies, attackers send a follow-up link disguised as project documents or a procurement portal that leads to a fake Microsoft 365/Google login page to steal credentials and sometimes MFA or session tokens.

Key findings

• Fortra tracked a "12-fold increase" in malicious emails mentioning “RFQ” between Oct 2025 and Sep 2026.
• In "nearly 73%" of cases, the lure led to a credential-stealing page.
• Attack flow: a minimal initial RFQ message prompts a reply, then the attacker sends an external link posing as "project drawings," an "RFQ package," a "secure file transfer," or a "procurement portal."
• Phishing pages commonly impersonate "Microsoft 365" or "Google Workspace" sign-ins and may capture "MFA approvals, one-time passcodes, cookies or session tokens."
• Emails came from "664 different sender domains," limiting the effectiveness of blocklists/reputation alone.
• Compromised mailboxes can be used for follow-on fraud like "payment-redirection fraud" and "invoice manipulation."

Who’s being targeted

• Commonly targeted roles: Sales, Procurement, Customer-facing teams, Finance (AP/AR), Executive assistants.
• Affected industries: Any industry with sales, procurement, and customer-facing teams.
• Attack channels: email, website.
• Impersonated: A buyer/purchasing manager/procurement specialist at another company, Procurement portal / secure file transfer for the supposed RFQ.

Awareness takeaways

• Treat unexpected RFQ-style inquiries as a known phishing pattern, especially when the first email is vague.
• Be cautious of follow-up links claiming to be “project drawings,” “RFQ package,” or “procurement portal,” especially when they lead to a Microsoft 365/Google login prompt.
• Don’t rely only on blocklists or sender reputation checks; verify the requester through trusted channels when possible.
• Assume mailbox compromise can lead to broader business fraud (invoice/payment changes) and respond quickly to suspected account takeover.

Red flags to watch for

• Message is unusually short and provides almost no project details
• Sender is unfamiliar but asks for business action immediately
• The request is framed as an opportunity to lower suspicion
• External link arrives only after you reply, pressuring you to trust the conversation
• Link leads to a login prompt for Microsoft 365/Google Workspace unrelated to the sender’s organization
• Login page asks for MFA/one-time passcodes or triggers approval prompts unexpectedly