RFQ‑Themed Phishing Surge Targets Sales and Procurement Teams, 12‑Fold Rise in Credential‑Stealing Emails
What Happened — Researchers at Fortra observed a 12‑fold increase in malicious emails that reference “RFQ” (request for quotation) between Oct 2025 and Sep 2026. In roughly 73 % of the samples the lure leads to a spoofed login page that harvests business credentials, MFA tokens, or session cookies; a smaller share deliver malware.
Why It Matters for Trust & Control Assurance
- The campaign exploits routine business processes, precisely the scenario continuous control‑assurance programs aim to detect and document through user‑behavior analytics and phishing‑simulation evidence.
- Successful credential capture undermines identity‑based controls, eroding the audit trail needed to prove “least‑privilege” and “multi‑factor authentication” compliance.
- The breadth of sender domains shows that traditional blocklists alone are insufficient; a robust security‑awareness program provides the additional layer of human control that can be measured and reported.
Who Is Affected
- Sales, procurement, and customer‑facing teams across most industries (technology, manufacturing, professional services, etc.).
Recommended Actions
- Refresh phishing‑awareness training with RFQ‑specific scenarios and test with regular simulated attacks.
- Enforce MFA with anti‑phishing protections (e.g., conditional access, push‑notification approval).
- Deploy email‑gateway and user‑behavior analytics that flag anomalous “RFQ” language and unknown sender domains.
- Capture training completion and phishing‑simulation results as continuous evidence for audit readiness.
Source: Help Net Security
Technical Notes
- Attack vector: targeted phishing (social engineering).
- Lure: short “RFQ” request, often with a link to a cloned Microsoft 365 or Google Workspace sign‑in page.
- Payload: credential harvesting; occasional malware drop.
Source: same as above