The emails were mass reported, up to the point there was an internal message sent around to stop reporting them because they are legitimate. Of course, no action was taken to make them look less suspicious.

If I’d ever want to phish someone at my company, I’d know exactly what to do. Make the email look exactly like the training ones.