Threat reportPhishingTL-2026-3742
RFQ (Request for Quotation) Phishing Campaigns Targeting Sales and Procurement Staff
RFQ (Request for Quotation) Phishing Campaigns Targeting (TL-2026-3742), also tracked as RFQ phishing, is a medium-severity phishing campaign, first published 2026-10-16. It has no confirmed attribution, affects Microsoft Microsoft 365 (brand impersonated by credential-harvesting, maps to 11 MITRE ATT&CK techniques (T1056.003, T1078.004, T1111), and is covered by 9 detection rules and 4 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-3742
- Threat ID
- TL-2026-3742
- Also known as
- RFQ phishing, Request for Quotation phishing, Project invitation scams
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- sales, procurement, manufacturing, business-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
How RFQ (Request for Quotation) Phishing Campaigns Targeting works
Fortra Intelligence and Research Experts (FIRE) report a 12-fold increase in RFQ, project-invitation and procurement-inquiry phishing emails between October 2025 and September 2026, aimed at sales, procurement and customer-facing staff. Nearly 73% of RFQ lures led to credential phishing sites (Microsoft 365 / Google Workspace look-alikes), spread across 664 distinct sender domains.
Fortra's FIRE team is tracking a sustained rise in emails that use requests for quotation, project invitations and procurement inquiries as a phishing pretext. The messages impersonate prospective buyers asking for pricing, availability or participation in a project, and are aimed at roles for which RFQ traffic is routine: sales, procurement and customer-facing teams. Between October 2025 and September 2026 Fortra observed a 12-fold increase in malicious emails containing 'RFQ'.
The goal of the lure is to get the recipient to open an attacker-controlled file-sharing, document-viewing or procurement portal, via links to 'project drawings', 'RFQ packages' or 'procurement portals'. Often the attacker first asks the recipient to confirm availability or promises project specifications, and then introduces the external link after the recipient replies. Nearly 73% of RFQ lures led to credential-phishing pages impersonating Microsoft 365 or Google Workspace. These pages are reported to collect credentials, MFA approvals, one-time passcodes, and cookies / session tokens. A smaller share of the emails delivered malware; the available summaries do not name the malware families.
Fortra identified 664 distinct sender domains, which makes sender-reputation and domain-blocklist filtering less effective. Secondary analyses of similar RFQ lures (retained examples, not tied to this specific Fortra dataset) describe fake document-viewer portals imitating Excel Online or a 'secure attachment' viewer, with stolen credentials tested immediately against the real mail service, MFA prompts relayed to capture session tokens, and the compromised mailbox then used for business email compromise such as changed-bank-details fraud.
Likely impact to victim organizations is account compromise, internal and external phishing sent from legitimate mailboxes, payment-redirection and invoice-manipulation attempts, fraudulent purchase requests, exposure of customer and project information, and reputational harm. This is a financially motivated, unattributed, opportunistic campaign class; no named actor, nation-state, CVE, or network IOCs (IPs, domains, URLs, hashes) were published in the sources available. The Fortra primary blog could not be retrieved directly (HTTP 403), so details here rely on secondary summaries of it. A related but distinct RFQ fraud type, 'net financing' RFQ scams documented by Proofpoint in July 2025, steals physical goods rather than credentials and is noted for context only.
MITRE ATT&CK techniques used in TL-2026-3742
Credential Access
T1056.003 Input Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie
Initial Access
T1078.004 Valid Accounts; T1566.001 Phishing; T1566.002 Phishing
Execution
Lateral Movement
Resource Development
T1583.001 Acquire Infrastructure
Defense Evasion
Impact
Affected products and versions in RFQ (Request for Quotation) Phishing Campaigns Targeting
Remediation for RFQ (Request for Quotation) Phishing Campaigns Targeting
Immediate actions
- Alert sales, procurement and customer-facing staff to RFQ / project-invitation lures that link to external file-sharing or procurement portals
- Hunt mail logs for inbound messages with RFQ, quotation, bid invitation or procurement subjects followed by user clicks to newly seen domains
- Revoke sessions and reset credentials for any user who entered credentials on an RFQ portal; review mailbox rules and recent sign-ins for the account
- Require out-of-band verification for any change to payment or bank details
Workarounds
- Verify unknown buyers independently through official websites and separately sourced phone numbers
- Open unfamiliar documents in sandboxed viewers and check the address bar for the real domain before signing in
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/passkeys) so relayed OTPs and approvals do not yield usable sessions
- Do not rely on sender-domain reputation alone, since 664 distinct sender domains were observed; add URL and landing-page analysis and click-time protection
- Use conditional access and token-binding controls to limit replay of stolen session cookies
- Run targeted phishing awareness for sales and procurement roles
Timeline of RFQ (Request for Quotation) Phishing Campaigns Targeting
- Proofpoint publicly details a distinct 'net financing' RFQ scam (goods theft, 19 domains disrupted); noted as related background, not part of the credential-phishing dataset
- Start of Fortra's October 2025 - September 2026 observation window for malicious emails containing 'RFQ'
- Trojan Killer last reviews a retained RFQ lure example ('Document Ready for Review' / 'Review RFQ Securely'); described as an example, not evidence of an ongoing campaign
- End of Fortra's observation window; volume of RFQ-themed malicious emails is 12 times that of October 2025
- Fortra FIRE publishes 'The Rise in RFQ and Project Invitation Scams'; reported by The IT Nerd the same day (73% credential phishing, 664 sender domains)
- Help Net Security reports on the campaign, quoting Fortra researcher Cadence Riddle on MFA, OTP and session-token capture
Sources cited for RFQ (Request for Quotation) Phishing Campaigns Targeting
- Hackers disguise phishing as promising business opportunities (Help Net Security)
- FIRE Report: RFQ Phishing Emails Surge 12-Fold (The IT Nerd)
- The Rise in RFQ and Project Invitation Scams (Fortra FIRE)
- Price Quotation Request Email Scam: How The Fake RFQ Works (MalwareTips)
- Vendor Evaluation Email Scam: Fake RFQ Login Theft (Trojan Killer)
- Widespread Net RFQ Scam Targets High-Value Goods (Infosecurity Magazine)
- This devious RFQ scam is letting hackers steal real-life goods (TechRadar)
Detection coverage for TL-2026-3742
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3742 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.