The most convincing phishing pretext of the past year did not claim your account was locked. It asked whether your company could quote on an upcoming project. Fortra’s Intelligence and Research Experts team, known as FIRE, reported on October 15, 2026 that malicious emails containing request for quotation language increased twelvefold between October 2025 and September 2026. Credential phishing was the most frequent outcome, with nearly 73% of RFQ lures leading to a site built to collect login details, and some campaigns delivering malware instead.
The structure of the attack explains why it works. The first message is deliberately sparse: it may name a purchasing manager or company representative, ask the recipient to confirm availability or submit a quote, and offer almost no detail about the project itself. That is normal buyer behavior, and sales and procurement staff answer these messages every week. Only after the recipient replies does the attacker introduce an external link, described as project drawings, an RFQ package, a secure file transfer or a procurement portal. The page behind it imitates a Microsoft 365, Google Workspace or similar business sign-in, and depending on the kit used it may also try to capture MFA approvals, one-time passcodes, cookies or session tokens.
Why reputation filters struggle with this one
The FIRE analysis found 664 distinct sender domains behind the RFQ-matched population. The researchers believe these include disposable domains, webmail accounts, compromised legitimate accounts and domains chosen to resemble real companies. That footprint matters for defenders because sender reputation and blocklists remain useful but cannot be the sole basis for detection. A fresh domain that has never sent spam carries no bad reputation, and a hijacked mailbox of a real company carries a good one.
The business framing does the rest of the work. Fortra researcher Cadence Riddle notes that the RFQ context may lower a recipient’s suspicion when they encounter a login prompt. An employee who expects to open a protected document is less likely to question a sign-in page, and the attackers count on that expectation.
What a compromised mailbox becomes
The consequences documented in the research go well beyond a stolen password. An attacker inside a business mailbox can search it for customer information, invoices, payment instructions, internal contacts and details of ongoing projects. The account can then be used to send phishing emails to coworkers, customers and suppliers who have every reason to trust the sender. Payment-redirection fraud, invoice manipulation and fraudulent purchase requests are among the listed outcomes, along with reputational damage even when no direct financial loss occurs.
That second stage is where an organization’s own domain enters the story. Lateral phishing sent from a genuinely compromised mailbox is fully authenticated mail. It passes SPF, DKIM and DMARC because it really is your tenant, your user and your DNS. The controls that stop it are phishing-resistant sign-in, conditional access and fast detection, not the authentication layer itself.
Where DMARC earns its place in this campaign
DMARC cannot judge whether a stranger’s RFQ is sincere, and it is honest about that boundary. What it does is close two specific doors this campaign relies on.
The first is domain lookalikes. Fortra observed domains selected to resemble real companies among the sender population. Organizations that enforce DMARC with p=reject across their domains, including lookalike defensive registrations, make it harder for anyone to spoof their name in the procurement conversation at all.
The second is visibility. Once a mailbox is compromised and starts sending to customers and suppliers, aggregate DMARC reports show new sending sources appearing as your domain, which is one of the earliest observable signs that a tenant is being abused. Sender reputation cannot alert you to your own compromised account. Your reports can.
What to do this week
Fortra’s guidance is practical and does not require banning links for teams whose job is to open documents from strangers. Verify prospective buyers independently, using contact information from an official website or public business directory, never the phone number or link supplied in the unsolicited message. Do not enter organizational credentials into a buyer-provided or unfamiliar project site, and confirm the platform through an independent channel if a package requires sign-in. Flag combinations of RFQ language, new or low-reputation sender domains, missing RFQ numbers or project scope, and sign-in walls in front of project documents. And watch your own outbound authentication, because the fastest growing threat to your customers is a message sent from your own compromised mailbox.
Phishing pretexts will keep borrowing from legitimate business workflows, but authentication remains the layer that guarantees nobody can send as your domain without you knowing. Excello Mail turns your DMARC, SPF and DKIM reports into a clear, continuous picture of every service sending as your domains, so you spot a compromised mailbox or a rogue sender before your customers do. Sign up for free to Excello Mail and keep your domain out of the reply chain.