Executive Summary
The Fortra Intelligence and Research (FIRE) team is tracking a 12-fold increase in emails using requests for quotation, project invitations, and procurement inquiries as a phishing pretext from October 2025 – September 2026. These messages impersonate prospective buyers seeking pricing, availability, or project participation. Their purpose is not to obtain a legitimate quote, but to persuade a recipient to access an attacker-controlled file-sharing, document-viewing, or procurement portal.
RFQ communication is routine for sales, procurement, and customer-facing teams in many organizations. A short request for availability or a promise to send project specifications can appear credible, especially when it is framed as a potential business opportunity. Once the recipient responds however, the attacker typically introduces an external link designed to collect business credentials, MFA information, or session data.
The likely impact to victim organizations includes account compromise, internal and external phishing from legitimate mailboxes, payment-redirection attempts, exposure of customer or project information, and reputational harm. The primary actions are to independently verify prospective buyers before accessing external portals, prevent business credentials from being entered into unverified sites, preserve suspicious messages and links for analysis, and improve detection of recurring RFQ language and second-stage destinations.
Introduction
This intelligence was produced because Fortra’s FIRE Team identified a sustained increase in messages containing RFQ-related language. From October 2025 through September 2026, malicious emails containing the term “RFQ” increased 12-fold.
Rather than claiming that an account has been locked or an invoice is overdue, attackers are targeting businesses in these campaigns by presenting an opportunity to bid on a project, provide materials, or become a supplier. The intent behind this approach is to move an employee into a conversation before the malicious destination is introduced.
The analysis has identified credential phishing as the most frequently recorded classification for RFQ-related activity, with nearly 73% of RFQ lures leading to a phishing site requesting victim credentials. This makes the rise in RFQ activity relevant not only as a spam trend, but as an expanding pathway to business-email compromise and account takeover.
Threat Landscape
RFQ and project invitation scams operate within a broader environment where attackers increasingly abuse trusted business workflows. Procurement, contracting, vendor onboarding, project planning, and quote requests all create legitimate reasons for organizations to exchange documents and use external portals. Attackers take advantage of that familiarity by making their messages brief, professional, and intentionally incomplete.
The activity is also infrastructure diverse. The RFQ-matched population contained 664 distinct sender domains. This may reflect the use of disposable domains, webmail accounts, compromised legitimate accounts, and domains selected to resemble real companies. The broad sender-domain footprint means that sender reputation and blocklists remain useful, but cannot be the sole basis for detection.
An emerging risk is the use of increasingly convincing second-stage sites. Attackers can imitate document portals, cloud storage pages, shared workspaces, and business sign-in experiences. The context supplied by the RFQ email may lower a recipient’s suspicion when they encounter a login prompt or request to open a protected document.
Threat Specifics
The origin of these campaigns is typically an unsolicited procurement inquiry sent to a supplier, contractor, or business likely to respond to requests for pricing. The attacker’s intent is to establish enough credibility to move the recipient from email to a controlled web destination. The initial message often asks whether the company is available to quote on an upcoming project, review requirements, or receive a full requisition.
The first message is usually sparse by design. It may identify a purchasing manager, procurement specialist, executive, contractor, or company representative, but it often provides little detail about the actual project. If the recipient responds affirmatively, the attacker sends a link represented as project documents, drawings, an RFQ package, a secure file transfer, or a procurement portal.
Credential phishing is the most observed outcome in the available classification data. The linked site may imitate a legitimate service and request the victim’s Microsoft 365, Google Workspace, or other business credentials. Depending on the phishing kit used, if used at all, the site may also attempt to collect MFA approval details, one-time passcodes, cookies, or session tokens. Other recorded classifications included malware distribution.
Common indicators include generic language such as “ongoing project,” “confirm availability,” or “submit a quote,” no identifiable RFQ number or project scope, an unfamiliar external portal, a mismatch between the sender’s claimed company and its domain, and requests to sign in before accessing project documents. These indicators are not independently conclusive, but their combination should trigger verification before a recipient opens a link or enters credentials.
Impact Assessment
The immediate operational impact of a successful campaign is the possible compromise of an employee account. An attacker with access to a business mailbox may search for customer information, invoices, payment instructions, internal contacts, and active projects. They may also use the compromised account to send more credible phishing messages to coworkers, customers, or suppliers.
The financial exposure can extend beyond the initial credential theft. Compromised accounts may support payment-redirection fraud, invoice manipulation, fraudulent purchase requests, or misuse of established vendor relationships. If an attacker obtains access to procurement or sales communications, they may be able to identify ongoing transactions that can be impersonated more convincingly.
There is also a reputational risk for victim organizations. A successful compromise may cause customers, suppliers, or partners to receive fraudulent messages from a trusted organizational address. Even when no direct financial loss occurs, an incident can disrupt normal business communication, consume investigation resources, and reduce confidence in the organization’s security practices.
The teams most exposed are those whose normal work includes reviewing quotations, project documents, customer inquiries, or new business opportunities. Their legitimate need to access external information makes a blanket prohibition on links impractical. Organizations should instead give them a clear and safe method for verifying prospective buyers and reviewing suspicious material.
Mitigation Guidance
Organizations should prioritize independent buyer verification before an employee accesses an external project portal. Sales, procurement, and customer-facing teams should verify the organization using contact information obtained from an official website, established vendor record, or public business directory. They should not rely on a phone number, email address, or link supplied only in the unsolicited message.
Employees should not enter organizational credentials into a buyer-provided or unfamiliar project site. If a project package requires authentication, the recipient should confirm the buyer and platform through an independent channel before signing in. This control directly addresses the most frequently observed outcome, credential phishing.
Email-security and detection teams should flag combinations of RFQ-related language, new or low-reputation sender domains, unfamiliar external-link destinations, reply-to mismatches, and recurring message templates. Suspicious messages should be preserved with their original headers, sender details, and destination URLs. Links should be analyzed only in an isolated environment rather than opened from a production workstation. Confirmed phishing domains should be reported through the appropriate hosting, registrar, email security, and law enforcement channels.
Closing Notes
RFQ and project invitation scams should be treated as a growing credential-phishing threat rather than as routine unsolicited sales outreach. The sustained rise in message volume, the large number of credential-phishing classifications, and the use of 664 distinct sender domains demonstrate that attackers are adapting a credible business workflow into a scalable delivery mechanism.
The immediate priority for organizations is to protect employees who regularly receive quote requests and project documentation. Sales and procurement leadership should own buyer-verification procedures, while security and IT teams should own detection, account protections, and incident response.
By treating the RFQ process as a targeted abuse case with clear controls and owners, organizations can reduce the likelihood that a routine business inquiry becomes an account-compromise incident.
Fortra helps organizations detect and respond to phishing threats that abuse normal business processes, including RFQ and project-invitation campaigns. FIRE tracks the sender infrastructure, lure patterns, and malicious destinations associated with this activity to help organizations detect related threats early. This intelligence supports blocking, investigation, incident response, and disruption or takedown efforts where appropriate.
