Phishing disguised as RFQ business inquiries up 12-fold

Fortra tracked a 12-fold increase in malicious emails mentioning "RFQ" (request for quotation) between October 2025 and September 2026. In nearly 73% of cases, the lure led to a page built to steal Microsoft 365 or Google Workspace credentials, including MFA codes and session tokens.

• 12-fold rise in RFQ-themed malicious emails over a year
• 73% of links led to credential and MFA theft pages
• Emails came from 664 different sender domains
• Sales, procurement and customer-facing staff most targeted