I had a previous company send out a company wide announcement from a sketchy sender with a weird file attachment(apparently it's a voice mail file format), and the email was essentially listen to this attachment with no signature or anything else. They had to send out a second email explaining the suspicious email is actually real. Companies seem intent on ensuring there is minimal difference between phishing and legitimate email.