# Phishing Campaign Targets Bid Responders

A phishing campaign reported on October 27, 2026, targets sales professionals with fake invitations to bid and purported contract documents, then directs recipients to a fraudulent Microsoft sign-in page to steal credentials. The report identifies no government agency, legitimate procurement opportunity, named threat actor, or malware deployment; the procurement risk is credential theft through bid-related communications that appear authentic.

- Procurement and sales teams should verify bid invitations and document-sharing links through trusted, independently established channels before opening documents or entering credentials.
- Organizations handling government bids can use this campaign as a reminder to treat unexpected solicitation materials and sign-in prompts as potential phishing, rather than as evidence of a real contracting opportunity.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 28, 2026

### Sources
- [#threatreport #LowCompleteness
Locked and Loaded: Phishing through Fake Bids and Protected Documents | 27-10-2026
Source: https://t.co/laQw6anuAH
Key details below ↓

🎯Victims: Sales professionals

🤖LLM extracted TTPs:`
T1027.013, T1598.002, T1598.003, T1656

🧨IOCs:
 - Url: 4
](https://x.com/rst_cloud/status/2115407448315924706) - twitter-agency