Interesting read. One of my domains has been hit with a lot spear phishing emails lately--5 or more a day sometimes. I don't think it is anything this sophisticated but they are being clever and spoofing email headers so I get them from email addresses on my own domain name. The business associated with the domain is a one man operation with only 3 real email addresses on it so it is easy to tell the fake ones but that wouldn't be the case in a large organization.
