---
title: Fortra: RFQ and project-invitation phishing up 12-fold in a year; about 73% lead to credential-harvesting sign-in pages | ctxsec
url: https://ctxsec.com/items/fortra-rfq-phishing-12x-2026-10
description: ""
status: "confirmed (Fortra FIRE research, Oct 15)"
published: 2026-10-16
---

> 

[← Cybersecurity News](/news) · [markdown](/items/fortra-rfq-phishing-12x-2026-10.md)

confirmed (Fortra FIRE research, Oct 15)

2026-10-16

### Fortra: RFQ and project-invitation phishing up 12-fold in a year; about 73% lead to credential-harvesting sign-in pages

Fortra's FIRE team (Cadence Riddle, Oct 15) says malicious emails using the term 'RFQ' rose 12-fold from October 2025 to September 2026. The opener is short and vague (confirm availability, send a quote); once someone replies, the attacker sends a link to 'drawings', an 'RFQ package', file share or procurement portal. Nearly 73% of classified lures led to fake Microsoft 365, Google Workspace or similar logins, some kits also grabbing MFA codes, approvals or session cookies; a smaller share delivered malware. The mail came from 664 sender domains, so reputation and blocklists alone won't catch it. Sales and procurement mailboxes are the target, and a hijacked one feeds invoice and payment-redirection fraud.

Sources: [Fortra: The rise in RFQ and project invitation scams](https://www.fortra.com/blog/rise-rfq-and-project-invitation-scams) · [Help Net Security (secondary)](https://www.helpnetsecurity.com/2026/10/16/rfq-phishing-emails-sales-procurement-staff/)