Sales people got the email they are paid to want. Short. Polite. A little urgent. Can you quote this project next week.

Cadence Riddle at Fortra tracked a 12-fold jump in malicious messages that mentioned RFQ between October 2025 and September 2026, and in nearly 73 percent of those cases the next click was a page built to steal logins. Your cybersecurity awareness slide still says don’t open unexpected attachments. Your quota says answer every inbound request before the other vendor does.

Your Comp Plan Is Doing Recon for Them

Nobody in sales gets a bonus for being suspicious of a buying signal. That’s the whole job: a stranger writes, you reply, you attach a PDF, you log into whatever portal they swear legal requires. Attackers noticed. They aren’t spray-painting mailbox-verification banners at procurement. They’re asking whether your firm can bid a job, in the same dozen words a real facilities manager would use on a Tuesday.

Help Net Security’s reporting is the part your board will skip. The messages are short. They look like work. They land in inboxes whose managers measure response time. Once a mailbox is already compromised, the next RFQ comes from a domain your staff has seen, which is how you pull a second victim in the same supply chain without a single urgent-invoice cliché.

You can feel the bad habit from here. Someone forwards the thread to estimating. Someone else opens the bid portal on a laptop that also holds SSO. Someone saves the attachment next to last year’s real quotes. Threat-protection tools that grade on payload entropy stay quiet because there often is no payload. There’s a URL, a tone, and a deadline.

The credential page is doing what your IdP login page does. Logo, email field, password field, maybe an MFA prompt that isn’t yours. Seventy-three percent of Riddle’s sample went there. The rest will hurt in different ways: a dropper, a vendor bank-change follow-up, or a quiet inbox rule that forwards every sent quote to an address nobody inventoried. If your security hardening program still ranks phishing-simulation click rate as the KPI, you’re measuring the wrong population. The people who fail RFQ lures are often your highest performers. They were supposed to engage.

Your Cybersecurity Stack Never Sees the RFQ Thread

Unit 42’s September 2026 snapshot of initial access should not surprise you. Edge exploits, credential abuse, and phishing are still how adversaries walk in. You already burn change windows on the edge. Credential abuse and phishing are the business-process hole you keep filing under user education, which is how an RFQ becomes tenant access without touching a VPN concentrator.

The RFQ is that phishing line item with a purchase-order costume. Credential abuse is the handoff after sales types into the lookalike. Cyber security programs that pour budget into mail sandboxing still miss the thread that never included a file. The conversation is the exploit. Your SIEM never indexed “can you bid Friday.”

APT29’s CaptiveCrunch campaign is the same social contract, moved onto the network. Poison DNS on the box, present a captive portal, wait for the human to do the responsible thing and authenticate so they can get online. You trained people to complete that screen in airports. You trained them to complete RFQs at their desk. Attackers are renting both habits.

If the prompt looks like work, your users will finish it.

Defense in depth on paper includes people. In production it usually means a firewall policy and an EDR agent, neither of which parses a quote request. Threat detection that waits for a malware family name will grade this incident as a nothing-burger until the mailbox starts mailing your customers. Brute-force noise against SSH still dies at the border if you bother to ban it. This path never presents a login socket for you to drop.

Do This Before You Buy Another Awareness Module

Skip the poster. Change the workflow. You need controls that still work when the best closer in the region is chasing a fake job at 7:40 a.m.

• Confirm every first-time RFQ on a channel you already trust. Call the number on the company’s real website, not the number in the email, before anyone opens a “bid portal.”
• Revoke sessions and rotate credentials for anyone who touched a suspect RFQ domain. Pull refresh tokens and app passwords, not just the user password in the directory.
• Hunt inbox rules, forwarding, and OAuth grants on sales, estimating, and procurement mailboxes the same day. That’s the persistence, and it outlives the fake landing page.
• Require phishing-resistant MFA on mail, CRM, and remote access for every quota-carrying role. SMS next to a cloned login form is free reconnaissance for the attacker.
• Move official bid intake onto a form you own. Stop treating a shared inbox as the company’s RFQ API, then give sales a browser profile that cannot see SSO cookies when they “just check the customer’s site.”
• Put RFQ-themed lures in tabletop incident response, including the part where estimating forwards the thread to five other people, and watch for lookalike domains registered against your top customers’ names before those domains ever send mail.

IR That Starts at the Mail Gateway Is Already Late

Once someone replies, you’re in account-takeover territory. Incident response has to pull the CRM, the shared estimating drive, the vendor master file, and every mailbox the thread touched. The bid document they uploaded may have been real. The portal that received it was not. Close the click ticket and you will miss the week of quiet reading that follows.

Check sent items for other “we can bid this” replies. Check whether the attacker placed orders, changed ACH, or exported contacts. That’s the business impact, and it’s why this belongs in your runbook next to ransomware. A captive-portal prompt on a corporate laptop is an IR artifact too: local DNS that suddenly answers for your IdP, a new default route, a certificate popup a traveler clicked at a hotel.

Assume revenue teams will talk to strangers. Build the quote path so a stolen password is a bad day, not a tenant wipe. Least privilege on CRM exports. Alerts on mass downloads from sales roles. Out-of-band confirmation for any banking change that arrives inside a bid thread. That’s how you harden the way the company actually makes money. The attackers picked RFQ because the process already works. The cheaper fix is refusing to let the official way to win work be a random link from a stranger with a purchase-order story.

Sources

• Hackers disguise phishing as promising business opportunities
• Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
• How SentinelOne Blocked APT29’s CaptiveCrunch Campaign