Please stop calling it phishing. That word doesn't mean anything related to IT, email, or hackers. The first rule about naming new "things" is to give it a name that relates to that "thing's" definition. Phishing isn't it. We need to stop using that word.
What are the spoofed emails asking for? How would we know if the email we received was part of this email hack?
Thanks for the PSA!