Beyond the Quote: Deconstructing Advanced RFQ Phishing Campaigns Exploiting Business Trust

Beyond the Quote: Deconstructing Advanced RFQ Phishing Campaigns Exploiting Business Trust

In the evolving landscape of cyber threats, attackers continuously refine their social engineering tactics to bypass conventional security controls. A particularly insidious trend involves threat actors disguising sophisticated phishing campaigns as legitimate business opportunities, leveraging the inherent trust and operational cadences within corporate environments. Recent intelligence highlights a significant surge in attacks masquerading as Requests for Quotation (RFQs), a commonplace interaction in sales and procurement workflows.

The Escalating Threat of RFQ-Themed Phishing

Cybersecurity researcher Cadence Riddle at Fortra has meticulously tracked a staggering 12-fold increase in malicious emails explicitly mentioning “RFQ” between October 2025 and September 2026. This exponential growth underscores a calculated shift in attacker methodology, targeting the very processes that drive business operations. The efficacy of this lure is alarming: in nearly 73% of observed cases, recipients who engaged with these deceptive communications were directed to pages meticulously crafted to steal login credentials. This high conversion rate emphasizes the psychological effectiveness of impersonating a promising business lead, exploiting the eagerness of sales and procurement teams to respond to potential revenue streams.

The initial vector typically involves short, seemingly innocuous messages from compromised business email accounts. These messages often possess a deceptive brevity and urgency, asking whether a company can provide a quote on an upcoming project. Such requests are a daily occurrence for many organizations, making them inherently difficult to flag as suspicious without meticulous scrutiny. The threat actors exploit this operational familiarity, transforming a routine business inquiry into a high-probability credential harvesting operation.

Anatomy of a Business Opportunity Phishing Attack

Understanding the multi-stage nature of these attacks is crucial for robust defense:

• Initial Compromise and Reconnaissance: Threat actors often leverage previously compromised accounts or conduct open-source intelligence (OSINT) to identify target organizations and their key personnel in sales, procurement, or finance. This pre-attack reconnaissance allows for tailored spear-phishing attempts.
• Social Engineering Lure (RFQ): The core of the attack is the RFQ email. These are designed to appear legitimate, often using generic but convincing language, and sometimes mimicking real company names or referencing plausible project types. The sender’s email address might be spoofed or originate from a compromised account, lending an air of authenticity.
• Malicious Payload Delivery: Instead of a legitimate RFQ document or portal, the email contains a link to a credential harvesting site. These sites are often meticulously designed to mimic popular email service providers (e.g., Microsoft 365, Google Workspace) or corporate Single Sign-On (SSO) portals.
• Credential Harvesting: Once a user inputs their credentials into the fake login page, the data is exfiltrated to the threat actor. This immediately grants the attacker unauthorized access to the victim's email account and potentially other integrated corporate systems.
• Post-Compromise Exploitation: With access to a legitimate business email account, threat actors initiate Business Email Compromise (BEC) schemes, redirect payments, exfiltrate sensitive data, or launch further phishing campaigns internally and externally, leveraging the compromised account’s trust.

Advanced Tactics, Techniques, and Procedures (TTPs)

Modern RFQ phishing campaigns exhibit sophisticated TTPs, moving beyond simple bulk phishing:

• Domain Impersonation & Typo-squatting: Attackers register lookalike domains that are visually similar to legitimate organizations, relying on slight misspellings or alternative Top-Level Domains (TLDs) to deceive recipients.
• Dynamic URL Generation: Phishing links often incorporate base64 encoding, URL shorteners, or redirect chains to evade static URL analysis by Email Security Gateways (ESGs). They might also dynamically generate unique URLs per recipient.
• Legitimate Service Abuse: Hosting phishing pages on compromised legitimate websites or using legitimate cloud services (e.g., SharePoint, Google Docs) for hosting malicious documents or redirects to credential harvesting sites.
• Anti-Analysis Techniques: Phishing pages may include CAPTCHAs, IP blacklisting, or user-agent checks to deter automated analysis tools and security researchers.

Proactive Defense and Robust Mitigation Strategies

Combating these advanced phishing threats requires a multi-layered, proactive security posture:

• Enhanced Email Security Gateways (ESGs): Deploy ESGs with advanced threat protection capabilities, including sandboxing, URL rewriting, real-time link analysis, and AI-driven anomaly detection for inbound email traffic.
• Multi-Factor Authentication (MFA): Implement mandatory MFA across all corporate accounts, especially for email and critical business applications. MFA significantly reduces the impact of credential harvesting by requiring a second verification factor.
• Comprehensive Security Awareness Training: Regularly train employees, particularly those in sales, procurement, and finance, on identifying phishing attempts. Emphasize vigilance for unusual sender details, generic greetings, urgent requests, and suspicious links. Conduct simulated phishing exercises.
• Endpoint Detection and Response (EDR) & Extended Detection and Response (XDR): Deploy EDR/XDR solutions to monitor for post-compromise activity, detect anomalous behavior, and respond swiftly to potential breaches originating from credential theft.
• Domain Monitoring and Brand Protection: Proactively monitor for typo-squatted domains and brand impersonations that could be used in future attacks.
• Strong Access Controls and Least Privilege: Limit access to sensitive systems and data based on the principle of least privilege, reducing the blast radius in case an account is compromised.

Digital Forensics and Incident Response (DFIR) – Unmasking the Adversary

When an RFQ phishing incident occurs, thorough forensic analysis is paramount for containment, eradication, and future prevention:

• Email Header Analysis: Scrutinize full email headers for SPF, DKIM, and DMARC authentication results, sender IP addresses, and routing paths to identify spoofing attempts or compromised legitimate senders.
• URL and Link Analysis: Deconstruct malicious URLs to identify redirects, final landing pages, and hosting infrastructure. Tools for reputation checking and sandbox analysis are critical here.
• Advanced Telemetry Collection: For deeper forensic analysis and threat actor attribution, security researchers often employ specialized tools for link analysis. Services like grabify.org can be invaluable in collecting advanced telemetry such as IP addresses, User-Agent strings, ISP details, and unique device fingerprints when investigating suspicious URLs. This data provides critical intelligence for network reconnaissance, aiding in the identification of attacker infrastructure and potential geographic origins, thereby strengthening incident response efforts and threat intelligence gathering.
• Log Analysis: Analyze mail server logs, proxy logs, web server logs, and authentication logs to trace the attack's propagation, identify compromised accounts, and assess the extent of unauthorized access.
• Threat Intelligence Integration: Correlate indicators of compromise (IoCs) with existing threat intelligence feeds to identify known attacker infrastructure, TTPs, and campaign overlaps.

Conclusion

The weaponization of routine business communications, particularly RFQs, represents a sophisticated evolution in phishing tactics. As threat actors continue to exploit the trust inherent in business interactions, organizations must implement a robust, multi-layered cybersecurity strategy that combines advanced technical controls with continuous human vigilance. Proactive defense, coupled with rapid and thorough digital forensics, remains the cornerstone of protecting corporate assets against these deceptive business opportunity scams.