![\"Realistic](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/exxonmobil-rfq-hero.png\" "\\"\\"")
<\/figure>\n\nOverview<\/h2>\n\nA supplier inquiry with realistic questions<\/h3>\n\n
The email appears to come from ExxonMobil LTD and asks whether the recipient can manufacture a requested product.<\/p>\n\n
It requests a minimum order quantity, unit price, lead time, OEM or ODM availability, and packaging details.<\/p>\n\n
Those are normal procurement questions.<\/p>\n\n
The message is signed by a supposed procurement manager named Celia Chow, which gives the recipient a person and job title to associate with the opportunity.<\/p>\n\n
The filename is designed to hide the real format<\/h3>\n\n
The message refers to `RFQ-62924-0187.pdf`, but researchers found an attachment ending in `.xls.html`.<\/p>\n\n
That double extension makes the file look related to a spreadsheet while revealing that it is actually an HTML document.<\/p>\n\n
When opened, the file displays a fake Gmail form with email and password fields. It is not a protected quotation, an ExxonMobil supplier portal, or a Google sign-in page.<\/p>\n\n
The real target is the supplier’s mailbox<\/h3>\n\n
The campaign does not need an advance payment at the first stage. It needs the email credentials of a person who handles manufacturing, quotations, customer relationships, or finance.<\/p>\n\n
A supplier mailbox can contain price sheets, customer lists, invoices, shipment schedules, tax documents, and ongoing payment conversations. That access is far more valuable than one fake quotation.<\/p>\n\n
- \n
- Subject contains RFQ-62924-0187 and another reference number.<\/li>\n
- Fake sender identity: ExxonMobil procurement staff.<\/li>\n
- Business request: price, MOQ, lead time, OEM or ODM, and packaging.<\/li>\n
- Attachment disguise: a PDF or spreadsheet-style name ending in HTML.<\/li>\n
- Real objective: collect Gmail or email credentials for account takeover.<\/li>\n<\/ul>\n\n
ExxonMobil is not associated with this campaign.<\/p>\n\n
The company warns that criminals use its name, logo, and employee identities in unsolicited business offers and advises people not to open attachments or links in suspicious emails.<\/p>\n\n
![\"Security](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/exxon-rfq-analysis.png\" "\\"\\"")
<\/figure>\n\nHow The Scam Works<\/h2>\n\n
Step 1: The email offers valuable business<\/h3>\n\n
A procurement inquiry can trigger optimism instead of fear.<\/p>\n\n
The recipient may imagine a major customer, a large production run, and a long-term contract before checking whether the buyer is real.<\/p>\n\n
Scammers send these messages to manufacturers, exporters, wholesalers, and service providers because those businesses routinely open specifications from new contacts. The workflow itself creates the opening.<\/p>\n\n
Step 2: Familiar procurement language lowers suspicion<\/h3>\n\n
MOQ, unit price, lead time, packaging, and OEM or ODM are ordinary supplier terms. They make the email sound like it was written by someone who understands sourcing.<\/p>\n\n
The questions also invite a reply. Even if the attachment is ignored, answering can confirm that the address is monitored and that the recipient is interested in new orders.<\/p>\n\n
Step 3: A famous company name supplies instant credibility<\/h3>\n\n
ExxonMobil’s name suggests scale, purchasing power, and formal procurement. A small supplier may hesitate to challenge the email because losing a genuine opportunity would feel costly.<\/p>\n\n
Branding is easy to copy. A display name, logo, executive name, or corporate address does not prove the message traveled through ExxonMobil’s systems.<\/p>\n\n
Step 4: The double extension disguises an HTML file<\/h3>\n\n
The attachment combines spreadsheet and web-page extensions.<\/p>\n\n
On systems that hide known file extensions, the ending may be difficult to notice and the icon may look like an ordinary browser or document.<\/p>\n\n
An HTML file can build a complete login form on the victim’s own device.<\/p>\n\n
Seeing a local file path in the browser does not make the form safe, because the form can still send entered data to a remote server.<\/p>\n\n
![\"Official](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/exxon-official.png\" "\\"\\"")
<\/figure>\n\nStep 5: The fake Gmail form asks the victim to verify<\/h3>\n\n
The observed page uses Gmail branding and a verification message. The story implies that the quotation is protected and that the recipient must confirm the email address before viewing it.<\/p>\n\n
A genuine ExxonMobil RFQ would not require a supplier to submit personal Gmail credentials into an attached HTML file.<\/p>\n\n
A real protected portal would have a known company domain, established onboarding, and separate account recovery.<\/p>\n\n
Step 6: The credentials are sent to the attackers<\/h3>\n\n
Anything entered into the form can be captured. The attackers may immediately attempt a real login, request a verification code, or trigger an approval notification on the victim’s phone.<\/p>\n\n
If the victim approves that prompt, the criminals can gain a working session even when multi-factor authentication is enabled. The fake quotation has then completed its real purpose.<\/p>\n\n
Step 7: The stolen account powers more convincing fraud<\/h3>\n\n
Attackers can read existing supplier conversations, learn who approves payments, and send follow-up messages from a trusted account.<\/p>\n\n
They may replace bank details, request deposits, or send the same RFQ lure to contacts.<\/p>\n\n
They can also create forwarding rules and delete security alerts. A quiet compromise can last longer than a noisy malware infection because normal business continues while the attacker watches.<\/p>\n\n
How a Real Procurement Request Should Be Verified<\/h2>\n\n
Start by inspecting the full sender and Reply-To addresses. ExxonMobil has publicly warned about non-company addresses in fraudulent solicitations. A free email account or lookalike domain should stop the process.<\/p>\n\n
Next, contact ExxonMobil through a number or supplier channel found on its official website. Do not use the phone number, signature link, or portal address supplied by the unexpected email.<\/p>\n\n
Ask whether the named buyer works in the relevant procurement group and whether the RFQ number exists. A legitimate buyer should understand why a new supplier wants independent verification.<\/p>\n\n
Established procurement usually includes supplier onboarding, contractual records, tax requirements, and an approved platform. An HTML attachment that asks for an email password belongs to none of those processes.<\/p>\n\n
Businesses should require two-person verification before changing customer bank details or paying a new supplier.<\/p>\n\n
The same rule helps when an unexpected buyer asks for deposits, samples, shipping fees, or confidential drawings.<\/p>\n\n
Company, Address, and Fulfillment Checks<\/h2>\n\n
ExxonMobil is the impersonated company<\/h3>\n\n
The real company did not send the analyzed email. Criminals borrowed its name and a procurement role to make the attachment credible.<\/p>\n\n
Do not treat the scam as evidence against ExxonMobil. Report it through official channels so the brand-security or fraud team can investigate the impersonation.<\/p>\n\n
The named employee is not proof<\/h3>\n\n
The signature uses the name Celia Chow and the title Procurement Manager. Names can be invented, copied from public profiles, or attached to roles the person never held.<\/p>\n\n
Verify the person through an independently obtained company contact. Do not ask the suspicious sender to verify themselves, because the same attacker controls the reply.<\/p>\n\n
The address and domain must match the official trail<\/h3>\n\n
A corporate address printed in a signature can be copied in seconds. The sending domain, reply path, official supplier portal, and confirmed internal contact are stronger evidence.<\/p>\n\n
Check every character in the domain. Extra hyphens, inserted words, alternate endings, and free-mail addresses are common signs of procurement impersonation.<\/p>\n\n
There is no real order or fulfillment instruction yet<\/h3>\n\n
The email asks for manufacturing details, but it does not establish a valid purchase order, contract, delivery address, or approved buyer.<\/p>\n\n
Do not buy materials or ship samples based on the message.<\/p>\n\n
Fraudsters may later provide a warehouse, freight forwarder, or address belonging to an unrelated company. Confirm every delivery and payment instruction through the verified procurement channel.<\/p>\n\n
Why Suppliers Are Vulnerable to Fake RFQs<\/h2>\n\n
Sales teams are trained to answer new inquiries quickly.<\/p>\n\n
A delayed quotation can mean a lost order, so the normal pressure of business works in the attacker’s favor before any explicit threat appears.<\/p>\n\n
Smaller suppliers may also lack a dedicated security team.<\/p>\n\n
The same person can manage sales, estimates, email, and banking, which lets one stolen mailbox expose several stages of the commercial process.<\/p>\n\n
International trade adds another layer. New buyers, unfamiliar names, different time zones, freight partners, and translated wording can all be normal, making a strange email easier to rationalize.<\/p>\n\n
A famous buyer changes the emotional balance. Employees may fear embarrassing the company by questioning a valuable customer, even though genuine procurement staff expect suppliers to verify new relationships.<\/p>\n\n
Attackers can gather product catalogs and staff names from public websites.<\/p>\n\n
A message that references the right material or capability may still be mass-produced from information the supplier published for legitimate customers.<\/p>\n\n
The answer is not to reject every new RFQ. It is to separate opening a lead from trusting a file.<\/p>\n\n
Verify the domain and buyer first, then exchange specifications through an approved channel.<\/p>\n\n
What Security Teams Should Check<\/h2>\n\n
Preserve the original email and attachment. Record the actual file type, hashes, sender authentication, Reply-To address, URLs, and the time each recipient interacted with the message.<\/p>\n\n
Review browser history and network telemetry for connections made after the HTML file opened.<\/p>\n\n
The visible form may load locally while submitting credentials to a remote server that never appears in the email body.<\/p>\n\n
Check Google or Microsoft identity logs for new sessions, unfamiliar devices, failed logins, and changes to multi-factor methods. Revoke suspicious sessions before relying on a password change alone.<\/p>\n\n
Search mailbox rules, delegated access, sent messages, and deleted items. An attacker who gained access may have hidden alerts or contacted customers before the incident was reported.<\/p>\n\n
Look for the RFQ number, filename pattern, display name, and procurement wording across all mailboxes. Similar messages may use different company names while keeping the same attachment structure.<\/p>\n\n
Coordinate with finance and sales to verify recent account changes, deposits, shipping requests, and sample orders. The compromise becomes a financial event when business decisions continue through the stolen identity.<\/p>\n\n
Security teams should notify affected customers before the attacker can define the story.<\/p>\n\n
A direct warning from a known phone number can stop a forged bank-change email from becoming a transfer.<\/p>\n\n
Resetting the password is only one part of containment. OAuth grants, app passwords, active browser sessions, forwarding rules, and recovery methods can preserve access after the original password stops working.<\/p>\n\n
If confidential drawings or pricing files were stored in the mailbox, identify which conversations the attacker could read.<\/p>\n\n
The response may need legal, contractual, or privacy review beyond ordinary account recovery.<\/p>\n\n
Keep the evidence long enough to recognize follow-up attempts. Criminals may return with a new buyer name, freight request, or payment instruction after learning how the supplier handles quotations.<\/p>\n\n
Procurement teams should maintain a verified buyer directory and require an independent call when a new contact requests credentials, unusual files, or rushed quoting.<\/p>\n\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n\n
- \n
- If you only read the message, report it.<\/strong> Do not open the attachment to confirm the filename. Preserve the original email for your security team.<\/li>\n
- Change the email password from a clean device.<\/strong> If credentials were entered, assume they were captured. Use a new, unique password and update any account that reused it.<\/li>\n
- Revoke sessions and authentication methods.<\/strong> Sign out unknown devices, remove app passwords, review recovery details, and reject verification methods you did not add.<\/li>\n
- Check mailbox rules and delegation.<\/strong> Remove unknown forwarding, deletion, archive, or reply rules. Review sent items, trash, and account audit logs.<\/li>\n
- Tell the business security and finance teams.<\/strong> Provide the email, attachment name, time opened, data entered, and any authentication prompts approved.<\/li>\n
- Pause payment and shipment changes.<\/strong> Independently verify recent bank-detail changes, deposits, sample requests, and delivery instructions connected to the mailbox.<\/li>\n
- Run a Malwarebytes scan if more than the form was opened.<\/strong> The observed HTML file steals credentials, but related campaigns may deliver malware. Scan if software, scripts, archives, or unexpected downloads were executed.<\/li>\n
- Use AdGuard as an additional barrier.<\/strong> It can block many malicious domains and redirect chains. It cannot revoke stolen credentials, so account recovery remains essential.<\/li>\n
- Report financial harm quickly.<\/strong> Contact the bank first, then file with the FTC, IC3, or the relevant cybercrime authority. Ask whether a transfer can be recalled.<\/li>\n<\/ol>\n\n
Is Your Device Infected? Run a Free Malware Scan<\/h2>\n\n
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. A quick way to check is to scan your device with Malwarebytes Free<\/strong>, one of the most trusted malware removal tools available. If you only visited a scam page and didn’t download or install anything, this scan is optional.<\/p>\n\n
The free version detects and removes the most common threats, including:<\/p>\n\n
- \n
- Adware<\/strong> \u2014 the cause of those annoying pop-ups<\/li>\n
- Browser hijackers<\/strong> \u2014 unwanted redirects and changed homepages<\/li>\n
- Trojans and spyware<\/strong> \u2014 hidden programs stealing your data<\/li>\n
- Potentially unwanted programs (PUPs)<\/strong> \u2014 software you never asked for<\/li>\n<\/ul>\n\n
\ud83d\udc49 Select your device below<\/strong> \u2014 Windows, Mac, or Android \u2014 then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.<\/p>\n\n
- Browser hijackers<\/strong> \u2014 unwanted redirects and changed homepages<\/li>\n
- Change the email password from a clean device.<\/strong> If credentials were entered, assume they were captured. Use a new, unique password and update any account that reused it.<\/li>\n
- If you only read the message, report it.<\/strong> Do not open the attachment to confirm the filename. Preserve the original email for your security team.<\/li>\n