One RFQ Number, Two Real Suppliers, 17 Minutes Apart

Two aviation suppliers emailed the same UK charter airline the same request for quotation, number 68453, 17 minutes apart. Neither sender was spoofed. Both were real.

Each message came from inside its own supplier's Microsoft 365 tenant. Each passed authentication at the airline's gateway. Each was a first-time sender, so there was no history to flag. Read one at a time, either message was a slightly odd vendor email. Read together, they were a campaign.

Same lure, different logo

The body was the same template in both: a one-line greeting, then a bold 24pt link styled as View_RFQ68453_.pdf. There was no attachment. The subject carried the same swap, Request for Quotation 68453_, with the suffix changed to match whichever supplier was sending.

That suffix is the tell. A real supplier does not append its own brand to a reference number in that way, and an operator running a template does exactly that to make each copy feel native to its sender.

Eight mailboxes across two airline domains received the pair, four per message. Recipients included a fleet support engineer and an engineering director. This was engineering staff, who are the people who actually open an RFQ.

The campaign key is not a sender

Both links resolved to the same path, /aerosupply/technic/aviation.html, on an unrelated web-design site. The path name reads as aviation-themed. What the page served was not established, so this post makes no claim about it. The site's owner has no shown connection to the attack and should be treated as a bystander.

The second copy also carried a signature anomaly: the visible text showed one person's address while the underlying mailto pointed to a different person's. The record does not say which side wrote that, so it is an oddity and nothing more.

None of that appears when you group mail by sender. Per-sender trust asks whether this supplier authenticated, whether this domain has a bad reputation, whether this person has written before. Both suppliers passed the first two questions and failed the third in the same harmless way.

Group by content instead and the picture changes. A reused reference number, a shared template and a shared landing path across two unrelated sender domains is not coincidence. It points to one hand using several supplier accounts, which is an inference from the overlap and not something the record proves.

See Your Risk: Calculate how many threats your SEG is missing

What each message showed alone

This is a different problem from a single compromised vendor with a mislabeled link, and from one message sent to several companies. Here the targets stay fixed and the senders rotate. The defender's only stable anchors are what the message says and where it points.

IOC table

The sender mailboxes belong to real suppliers whose accounts were used to send, and the gateway's own rewrite wrapper is not an indicator. Neither is listed.

Detection by fingerprint

The 2026 Verizon Data Breach Investigations Report (2026 Verizon Data Breach Investigations Report) puts phishing at 16% of breaches' initial access and the human element in 62%. In its email gateway attack mix, 80% is plain phishing. Plain phishing wins because it needs no exploit, only a believable sender and a believable ask.

This case followed that mix. A SOC analyst reported both messages, a human resolved both as malicious, and the copies were removed. What no one established, either way, is whether anyone clicked.

The MITRE mapping is T1566.002, spearphishing link, with masquerading (T1036.005) in the PDF-named link and user execution (T1204.001) as the intended next step.

The practical takeaway is narrow. Build detection that clusters inbound vendor mail by reference number, template shape and destination path across senders, and escalate when two authenticated first-time suppliers share a fingerprint. IRONSCALES platform data comes from 36,000+ security professionals across 18,000+ organizations, which is the kind of cross-tenant view that makes a repeated fingerprint visible. The broader pattern fits vendor email compromise, and the Microsoft Digital Defense Report 2024, the FBI IC3 2024 report and CISA phishing guidance all treat supplier-borne lures as a standing risk. For protection that goes beyond sender trust, see business email compromise protection.

Authentication tells you the mail came from where it says. It cannot tell you that the same person is behind two of those places.