Your sales team opens emails from strangers all day. Someone wants pricing, someone else has a project coming up, and another found you online and wants to know if you can handle a certain volume. Responding to those emails is part of the job, and attackers count on it.
Cadence Riddle, a cybersecurity researcher at Fortra, noticed a 12-fold increase in malicious emails using “RFQ” (request for quotation) as the bait in the last year. In nearly 73% of cases, the email led to a credential phishing page built to look like a Microsoft 365 or Google Workspace sign-in. The remaining share delivered malware. These emails came from 664 distinct sender domains, which makes blocking them by sender address essentially useless.
The lures aren’t elaborate. They’re short, professional, and sound like the kind of inquiry a sales or procurement person would expect to receive on any given Tuesday. “Their purpose is not to obtain a legitimate quote,” Fortra said, “but to persuade a recipient to access an attacker-controlled file-sharing, document-viewing, or procurement portal.”
Why Sales and Procurement Teams Are the Hardest to Protect
Most phishing advice boils down to some version of “be suspicious of unexpected emails.” That works reasonably well for someone in accounting or HR, where receiving a message from a stranger is unusual. It doesn’t work so well for a sales team whose entire job is responding to messages from strangers.
The same qualities that make a good salesperson, like responsiveness, openness to new opportunities, and a willingness to engage with an inbound inquiry, are exactly what this attack exploits. Telling a sales team to be suspicious of inbound inquiries can feel like you are telling them to be bad at their jobs. That means that you have to find the nuance in this situation.
This is an important distinction because it changes what you ask your team to do. The goal isn’t to make sales and procurement staff paranoid about every inbound message. It’s to give them a specific, low-friction step they take before clicking any link in an email from a new contact, and to make that step normal rather than optional.
What Happens When Someone Clicks
The typical attack flow looks like an employee receiving a short, professional email asking whether the company can quote on an upcoming project. The email looks legitimate, with a business name, a plausible request, and often no spelling errors or obvious red flags. Then, the employee replies or clicks a link to view the supposed RFQ document.
The page behind the link imitates a document portal or cloud storage page, something that looks like SharePoint, Google Drive, or a branded procurement platform. To view the document, the visitor is asked to sign in with their Microsoft 365 or Google Workspace credentials.
This is where the attacker gets you. A sign-in prompt asking for your business credentials in order to view a document from someone you’ve never dealt with is a red flag. Legitimate document sharing through Microsoft 365 or Google does not require the recipient to re-enter their credentials on a third-party site. If someone sends you a file and the link asks for your password before you can open it, stop.
For the employee who doesn’t stop, what follows depends on the phishing kit being used. Some simply harvest the username and password. More sophisticated versions capture the MFA approval, the one-time passcode, or the session cookie. When an attacker captures a session cookie, they don’t need the password or the MFA code. They paste the cookie into their browser, and they’re in, already authenticated, as far as Microsoft or Google can tell.
A password reset after the fact doesn’t fix this. The stolen session remains valid until it expires or is explicitly revoked through the identity platform’s admin controls. Resetting a compromised employee’s password and assuming the problem is solved is one of the most common mistakes in the response to this kind of incident.
A compromised sales mailbox is often how invoice fraud starts. If you want to understand how far an attacker with stolen credentials could get inside your environment, let’s have that conversation.
What Attackers Do With a Compromised Sales Mailbox
Getting into a sales or procurement mailbox isn’t the end of the attack. It’s the beginning of the next one.
A compromised sales mailbox gives an attacker access to ongoing transactions, vendor relationships, customer communications, and pricing information. They can read every thread, which reveals who the company does business with, which projects are in progress, and which invoices are outstanding.
From there, the most common next step is business email compromise, using the compromised account to send emails that appear to come from the legitimate employee. This can include a message to a customer asking them to update payment details for an upcoming invoice. Or a message to a vendor asking them to resubmit their banking information. Or a message to an internal finance contact routing a payment to a new account. All of it comes from a real address, in a real email thread, with the context of a business relationship behind it.
That trust is the asset. Once an attacker is inside a real account with history, the phishing emails they send from it are far more convincing than anything they could send from scratch.
Successful attacks of this type can lead to account compromise, payment-redirection fraud, exposure of customer or project data, and phishing campaigns that reach your customers and vendors under your name. And the possible reputational cost of the last one can outlast any direct financial loss.
A Process, Not a Feeling
As we said earlier, the defense for sales and procurement teams can’t rely on making people more suspicious. It has to be a specific, practicable step they take every time, regardless of how legitimate an email looks.
The best thing you can do is verify the organization using contact information obtained from an official website, established vendor record, or public business directory before clicking any link or entering any credentials. That means if a company contacts you claiming to have an RFQ, you look them up independently, find a phone number or contact email on their actual website, and confirm the inquiry is real before you click anything they sent you.
This adds maybe 90 seconds to the process of responding to a new inquiry. For a sales team fielding dozens of inbound messages a week, that’s a small and worthwhile investment. The key is making it a standard step rather than something that happens only when an email feels suspicious, because the best RFQ phishing emails don’t feel suspicious at all.
If a link from a new contact asks you to sign into Microsoft 365, Google, or any business platform before you can view a document, do not enter your credentials. Legitimate document sharing does not work this way. A real vendor or prospect sharing a file through Microsoft 365 or Google doesn’t require you to re-authenticate on a third-party page. Close the tab and verify the contact directly.
Additionally, standard push-notification MFA can be captured by some of the more sophisticated phishing kits in circulation. This is where the victim approves the prompt on their phone while the attacker uses the approval to get in. Phishing-resistant MFA, such as hardware keys or passkeys, binds the credential to the legitimate site and won’t hand over an approval to a fake one. For sales and procurement staff who are disproportionately exposed to this attack type, phishing-resistant MFA is worth prioritizing.
Finally, you should know what a compromised session looks like and how to respond. If someone on your team suspects they entered their credentials on a suspicious page, changing the password is step one but not the only step. An active session the attacker established before the password change may still be valid. Revoking active sign-in sessions through your Microsoft 365 or Google admin console terminates any access the attacker established, not just future login attempts.
Sales and procurement staff are the most exposed people in most small businesses, and most organizations find that out the hard way. MainNerve has been helping organizations understand and close these kinds of exposures for over 20 years. Reach out here to start the conversation. Or call us at 833-847-3280.
The Bigger Picture
RFQ phishing works because it targets a role that is integral to businesses. Unlike a finance department that can apply rigid rules about what links to click, a sales team that stops responding to inbound inquiries stops being a sales team. The attack is designed around that constraint.
The 12-fold increase Fortra documented in a single year is a specific, measured demonstration of how quickly attackers adapt when they find something that works at scale. RFQ lures are cheap to send, hard to block by sender, psychologically effective, and lead directly to the kind of access that enables fraud against customers and vendors who have no reason to doubt what they’re receiving.
The organizations that handle this well aren’t the ones with the most suspicious sales teams. They’re the ones with a clear, practiced process for vetting new contacts before engaging, staff who know what a suspicious sign-in prompt looks like, and phishing-resistant authentication for the people most likely to be targeted.
None of that requires a large investment. It requires deciding the process is non-negotiable and making it easy enough that a busy sales team can follow it without seeing it as an obstacle.
