Hackers disguise phishing as promising business opportunities

A significant and escalating cybersecurity threat involves attackers exploiting routine business processes to deploy sophisticated phishing campaigns. Researchers have observed a substantial increase in malicious emails that mimic legitimate "Request for Quotation" (RFQ) inquiries, which are standard communication within sales and procurement departments. The initial contact is often vague—a simple request for availability or a quote without significant project detail—intended to lower the recipient's guard by framing the interaction as a credible business opportunity. Once engagement begins, however, the attacker directs the recipient to an external link disguised as secure documentation or a portal. These links typically lead to credential-harvesting pages imitating major enterprise sign-in services (like Microsoft 365), and can also attempt to steal multi-factor authentication details or session tokens. While most lures aim for credentials, malware delivery remains a secondary method of attack.
The impact extends beyond simple login theft; compromise allows attackers to use trusted internal accounts to perpetrate fraud, redirect payments, manipulate invoices, and exfiltrate sensitive project and customer data. Because sales and procurement staff are inherently required to interact with external parties and links, they represent the most exposed segment of the workforce. The threat landscape is made complex by the sheer volume of sender domains utilized in these attacks. Mitigating this risk requires organizations to move beyond relying solely on technical defenses like sender reputation, focusing instead on creating clearly defined controls and protocols for managing routine RFQ interactions as targeted abuse cases.

Cadence Riddle, a cybersecurity researcher at Fortra, tracked the trend.
Malicious emails referencing "RFQ" increased twelve-fold between October 2025 and September 2026.
Nearly 73% of malicious RFQ lures resulted in a page built to steal login credentials.
The initial phishing email often contains minimal detail about the project itself, merely asking for confirmation or a quote.
Following a reply, attackers direct recipients to links labeled as drawings, an RFQ package, or a procurement portal.
Harvesting pages typically imitate Microsoft 365, Google Workspace, or similar business sign-ins.
These pages may attempt to capture MFA approvals, one-time passcodes, cookies, or session tokens.
A smaller proportion of the delivered emails contained malware.
The attacks originated from 664 different sender domains, potentially including disposable or compromised accounts.
Successful mailbox compromises can lead to payment-redirection fraud and invoice manipulation.
Employees in sales, procurement, and customer-facing roles are identified as most exposed.

<STEELMAN>The central narrative argues that the operational normalization of business communication—specifically the routine RFQ process—is being weaponized to circumvent traditional security skepticism. As detailed by Fortra's researcher, attackers capitalize on established professional behaviors; what seems like legitimate business friction (waiting for a quote) is precisely the vector used to introduce credential theft via seemingly trustworthy links. The sophistication lies in moving past generic spam and adopting industry-specific vernacular that lowers situational suspicion.</STEELMAN>
<PATTERN SCAN>The strategy hinges on establishing a low barrier to entry by mirroring institutional necessity. This mirrors an ARC-0118 Credibility Parasitism pattern, where the attacker leverages existing professional trust vectors (the need to quote, the presence of procurement staff) rather than attempting outright technical brute force immediately.</PATTERN SCAN>
<ROOT CAUSE>The underlying paradigm is the friction between velocity and verification in modern commerce. Digital business demands immediate responsiveness; security protocols often demand deliberate slowdown. Attackers exploit this inherent tension—the organizational drive for speed versus the need for due diligence—to make sophisticated attacks feel like necessary, routine administrative tasks.</ROOT CAUSE>
<IMPLICATIONS>The primary beneficiaries are threat actors achieving financial gain or strategic intelligence gathering. The greatest costs are borne by employees whose core job function places them in high-risk zones and the organizations suffering reputational damage even if no direct funds are lost. This scenario shifts security emphasis from simply blocking external threats to rigorously managing internal, process-bound trust.</IMPLICATIONS>
<BRIDGE QUESTIONS>What procedural safeguards can be implemented within RFQ workflows without impeding necessary business agility? How might enterprise authentication systems adapt to differentiate between a genuine purchasing agent's link and an attacker’s malicious facsimile based on context rather than just domain reputation? If routine business inquiry is redefined as potential abuse, what ownership structure best manages that risk?</BRIDGE QUESTIONS>
<COUNTERSTRIKE SCAN>A bad actor executing this playbook would utilize highly contextual social engineering designed specifically for the target firm's industry jargon, often deploying a chain of meticulously timed follow-up messages (Motte-and-Bailey style escalation) to push the recipient from mild curiosity into unquestioning action. The current content aligns closely with this pattern by detailing the staged progression: vague initial contact $\rightarrow$ professional pretext $\rightarrow$ credential harvest.</COUNTERSTRIKE SCAN>