Hackers target business staff with fake request for quotation emails
Attackers are increasingly using fake requests for quotation to lure sales and procurement teams to login credential theft pages.
FTMQ Security, written by our newsroom0 views
Hackers are compromising business email accounts using brief messages that ask whether companies can provide quotes for upcoming projects, Help Net Security reported. These requests for quotation target sales, procurement, and customer facing staff who regularly process routine business inquiries. [1]
According to Help Net Security, Fortra cybersecurity researcher Cadence Riddle tracked a 12 fold increase in malicious emails mentioning request for quotation between October 2025 and September 2026. In almost 73 percent of these cases, the fake requests directed victims to web pages designed to steal their login credentials. [1]
Phishing is a form of social engineering where attackers deceive individuals into revealing sensitive information or installing malicious software. The technique is frequently used as an initial access vector for credential theft, session hijacking, malware delivery, or command execution. [2]
In short
- Malicious emails referencing requests for quotation increased 12 fold between October 2025 and September 2026.
- Nearly 73 percent of request for quotation lures led directly to credential theft pages.
- The attacks specifically target sales, procurement, and customer facing personnel.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Hackers disguise phishing as promising business opportunitiesHelp Net Security, 2d ago (the report this story comes from)
Background
- [2]Phishing on Wikipedia
Our newsroom writes these reports with the help of software, from the 2 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Ransomware groups target staff families in forty percent of attacksData Breaches, 2h ago
- Meta suffers GitHub breach exposing corporate code and employee dataTop Stories, 5d ago
- SonicWall SMA 1000 Appliances Target of Critical Vulnerability Exploitation AttemptsTop Stories, 6d ago
More in Cybercrime and Scams
- KGB RAT trojan bypasses Windows Defender to spy on users3d ago
- Google releases Chrome update addressing 37 vulnerabilities including seven critical flaws3d ago
- Meta removes 3.7 million accounts linked to West African scam networks3d ago
- Ghanaian authorities raid Accra scam centre and arrest 19 people5d ago
- Lets Encrypt reduces default TLS certificate lifetimes to 64 days in 20276d ago
- AWS releases open source sandbox Strands Box for AI agents6d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.