I'm seeing a lot of W2 spearphishing.
From: $CEO_PERSON <$CEO_USERNAME@cornpany.com>
To: $HR_PERSON <$HR_USERNAME@company.com>
Hope your day is going well. I need to get a copy of the W2s, addresses, etc. for all employees. Please attach it as a PDF file.
Note the return domain CORNPANY.com not COMPANY.com.