I am using Google workspace to handle my domain emails. At a certain point, employees started to receive spoofing emails to their @mydomain.com
addresses. I blocked these emails and it worked.
However, after I blocked it, employees started to receive spoofing emails to their personal accounts from spammers who pretend to be the CEO of the company.
How did the attackers reach them on employee personal accounts? Is it a manual or systematic process?
I know I have no control over employees' personal emails. However, is there a way to block the sender on their accounts? Employees use free email providers not only one address.
Here is an example of received emails: