# RFQ (Request for Quotation) Phishing Campaigns Targeting Sales and Procurement Staff

> Fortra Intelligence and Research Experts (FIRE) report a 12-fold increase in RFQ, project-invitation and procurement-inquiry phishing emails between October 2025 and September 2026, aimed at sales, procurement and customer-facing staff. Nearly 73% of RFQ lures led to credential phishing sites (Microsoft 365 / Google Workspace look-alikes), spread across 664 distinct sender domains.

- **Published:** 2026-10-16T13:00:49Z
- **Last reviewed:** 2026-10-16T13:00:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3742
- **ID:** TL-2026-3742
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Fortra's FIRE team is tracking a sustained rise in emails that use requests for quotation, project invitations and procurement inquiries as a phishing pretext. The messages impersonate prospective buyers asking for pricing, availability or participation in a project, and are aimed at roles for which RFQ traffic is routine: sales, procurement and customer-facing teams. Between October 2025 and September 2026 Fortra observed a 12-fold increase in malicious emails containing 'RFQ'.

The goal of the lure is to get the recipient to open an attacker-controlled file-sharing, document-viewing or procurement portal, via links to 'project drawings', 'RFQ packages' or 'procurement portals'. Often the attacker first asks the recipient to confirm availability or promises project specifications, and then introduces the external link after the recipient replies. Nearly 73% of RFQ lures led to credential-phishing pages impersonating Microsoft 365 or Google Workspace. These pages are reported to collect credentials, MFA approvals, one-time passcodes, and cookies / session tokens. A smaller share of the emails delivered malware; the available summaries do not name the malware families.

Fortra identified 664 distinct sender domains, which makes sender-reputation and domain-blocklist filtering less effective. Secondary analyses of similar RFQ lures (retained examples, not tied to this specific Fortra dataset) describe fake document-viewer portals imitating Excel Online or a 'secure attachment' viewer, with stolen credentials tested immediately against the real mail service, MFA prompts relayed to capture session tokens, and the compromised mailbox then used for business email compromise such as changed-bank-details fraud.

Likely impact to victim organizations is account compromise, internal and external phishing sent from legitimate mailboxes, payment-redirection and invoice-manipulation attempts, fraudulent purchase requests, exposure of customer and project information, and reputational harm. This is a financially motivated, unattributed, opportunistic campaign class; no named actor, nation-state, CVE, or network IOCs (IPs, domains, URLs, hashes) were published in the sources available. The Fortra primary blog could not be retrieved directly (HTTP 403), so details here rely on secondary summaries of it. A related but distinct RFQ fraud type, 'net financing' RFQ scams documented by Proofpoint in July 2025, steals physical goods rather than credentials and is noted for context only.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure
- T1566.002 Phishing
- T1566.001 Phishing
- T1204.001 User Execution
- T1656 Impersonation
- T1056.003 Input Capture
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1078.004 Valid Accounts
- T1534 Internal Spearphishing
- T1657 Financial Theft

## Sources

- [Hackers disguise phishing as promising business opportunities (Help Net Security)](https://www.helpnetsecurity.com/2026/10/16/rfq-phishing-emails-sales-procurement-staff/)
- [FIRE Report: RFQ Phishing Emails Surge 12-Fold (The IT Nerd)](https://itnerd.blog/2026/10/15/fire-report-rfq-phishing-emails-surge-12-fold/)
- [The Rise in RFQ and Project Invitation Scams (Fortra FIRE)](https://www.fortra.com/blog/rise-rfq-and-project-invitation-scams)
- [Price Quotation Request Email Scam: How The Fake RFQ Works (MalwareTips)](https://malwaretips.com/blogs/price-quotation-request-email-scam/)
- [Vendor Evaluation Email Scam: Fake RFQ Login Theft (Trojan Killer)](https://trojan-killer.net/vendor-evaluation-email-scam-fake-rfq-login-theft/)
- [Widespread Net RFQ Scam Targets High-Value Goods (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/net-rfq-scam-targets-high-value/)
- [This devious RFQ scam is letting hackers steal real-life goods (TechRadar)](https://www.techradar.com/pro/security/this-devious-rfq-scam-is-letting-hackers-steal-real-life-goods)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3742