Fortra's FIRE team (Cadence Riddle, Oct 15) says malicious emails using the term 'RFQ' rose 12-fold from October 2025 to September 2026. The opener is short and vague (confirm availability, send a quote); once someone replies, the attacker sends a link to 'drawings', an 'RFQ package', file share or procurement portal. Nearly 73% of classified lures led to fake Microsoft 365, Google Workspace or similar logins, some kits also grabbing MFA codes, approvals or session cookies; a smaller share delivered malware. The mail came from 664 sender domains, so reputation and blocklists alone won't catch it. Sales and procurement mailboxes are the target, and a hijacked one feeds invoice and payment-redirection fraud.