It is highly unlikely that a malicious actor is sniffing email servers around the world to figure out how to craft phishing emails.

What is more likely, is:

1. these companies have been breached, and the malicious actor is simply reading the emails and address book of the compromised accounts
2. it's not targetted at all and that the malicious actors know the kinds of emails the companies' customers expect and just copy the style

Without specific details, I can't get more definite than that.

As a customer, there is no defence. The problem rests on the other company's side. You can help by reporting these phishing emails to the companies so they can follow up on their end.

It is highly unlikely that a malicious actor is sniffing email servers around the world to figure out how to craft phishing emails.

What is more likely, is:

1. your email accounts have been compromised
2. these companies have been breached, and the malicious actor is simply reading the emails and address book of the compromised accounts
3. it's not targetted at all and that the malicious actors know the kinds of emails the companies' customers expect and just copy the style

Without specific details, I can't get more definite than that.

As a customer, there is no defence for the last two. The problem rests on the other company's side. You can help by reporting these phishing emails to the companies so they can follow up on their end.

For the first one, the defence is pure account security practices:

• choose strong, long passwords (hopefully randomly generated and managed by a password manager)
• enable 2FA on as many accounts as you can

If you are already compromised, then you should immediately change all passwords.