Had the same exact experience in August. Amazing thing was I KNEW the email was phishing. I was asked to look at it by someone internally who was suspicious. I

Had the same exact experience in August. Amazing thing was I KNEW the email was phishing. I was asked to look at it by someone internally who was suspicious. I forwarded it to a Gmail account I use for dodgy items. I fired up a VM and logged in to the Gmail account. I looked at the email. I briefly examined the raw message (too briefly). Then I clicked on what I still thought was a Google Drive attachment. My first thought was "oh I've been logged out of Gmail for some reason". I was just about to login again when I decided to double check the URL and finally saw what was going on. I think most normal users would be very vulnerable to this. It's very subtle. Luckily the guy in accounts is paranoid.