I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are they attacking my email servers or my contacts' servers? Or is this us an mitm attack?
You will need to analyse message headers to determine what is going on.
Using the tool, check the from servers to find out if the emails pass through your contacts' servers or only your own.
It does not have to be even this. On the Internet, there are lots of so called fake mailers. One of it is for example Emkei's Fake Mailer https://emkei.cz/
So you will have to be careful until your contact persons will (or their admins will) set up SPF record which will prevent this type of the attack.
Probably one of your friends' email account got compromised and the list of contacts (which contains people that you know intimately) is now being used by scammers. This kind of scam involves the scammer impersonating your friend and pretending she's stranded in some foreign country and in distress (passport lost/stolen, etc) so she begs you to wire her some money. This kind of scam is easy to spot because of big red flags (unforeseen travels, friend writing to you in a different language than usual, etc).
By checking URL you can find malicious email in email before clicking on any link, check the link address. Mostly, hackers are using URL shortener for hiding the real URL.
Check sender email ID