RFQ Phishing Emails Exploit Business Communication Norms to Steal Credentials
Attackers are increasingly using 'request for quotation' (RFQ) phishing emails to trick sales and procurement staff, leading to credential theft via fake login pages.
Cybercriminals are leveraging a common business communication tactic—the request for quotation (RFQ)—to lure unsuspecting sales and procurement professionals into falling for sophisticated phishing schemes. Cybersecurity researcher Cadence Riddle observed a dramatic 12-fold increase in malicious emails employing the "RFQ" subject line over a one-year period, with the vast majority of these attempts culminating in credential harvesting.
These phishing emails are designed to appear as routine business inquiries. They often address recipients by name and ask about their company's ability to quote on an upcoming project, a familiar scenario for those in sales and procurement roles. The initial message typically contains minimal project details, making it seem like a genuine, albeit brief, business opportunity. This framing is crucial for attackers, as it can lower a recipient's guard when a subsequent login prompt appears.
Once a recipient responds to the initial bait, the attacker escalates the operation. They follow up with a link, purportedly leading to project specifications, RFQ packages, secure file transfers, or a dedicated procurement portal. The destination page is a meticulously crafted fake login portal, often mimicking legitimate platforms like Microsoft 365 or Google Workspace. Depending on the sophistication of the phishing kit employed, these pages are designed not only to steal usernames and passwords but also to capture multi-factor authentication (MFA) approvals, one-time passcodes, session cookies, or other sensitive authentication data.
Riddle's research indicates that nearly 73% of these RFQ-themed phishing attempts were aimed at stealing login credentials. A smaller percentage of the emails, however, were found to deliver malware directly. The attackers' ability to impersonate legitimate business communication is a key factor in the success of these campaigns, making it difficult for even experienced employees to discern malicious intent.
The sheer volume and diversity of sender domains used in these attacks—Riddle tracked 664 different domains—pose a significant challenge for traditional detection methods. These domains likely include disposable email addresses, compromised legitimate accounts, and domains specifically designed to mimic existing businesses. This broad footprint means that relying solely on sender reputation or blocklists is insufficient for effective defense.
When an attacker successfully compromises a business email account, the potential for further damage is immense. The compromised account can be used to access sensitive information such as customer lists, invoices, payment instructions, and details of ongoing projects. This information can then be weaponized to launch more targeted phishing attacks against colleagues, customers, and suppliers, leveraging the trust associated with the compromised sender.
The consequences of such a breach extend beyond immediate financial loss. Attackers can engage in payment redirection fraud, invoice manipulation, and fraudulent purchase requests. Even without direct financial theft, the incident can disrupt normal business operations, consume valuable IT and security resources for investigation, and severely damage the victim company's reputation and customer confidence.
To combat this evolving threat, organizations must educate their sales, procurement, and customer-facing teams about these specific tactics. Implementing robust security awareness training that highlights the nuances of RFQ-based phishing, coupled with technical controls like advanced email filtering and endpoint detection, is crucial. Furthermore, establishing clear protocols for verifying external business inquiries and links, especially those related to RFQs, can significantly reduce the risk of successful compromise.