Kyle Bubp from Savage Security recently wrote a three part blog post series highlighting a real-world scam targeted at us, The IT Company. Here's the basic background:

The IRS warned that phishers started a new scam which is particularly nasty and dangerous. This scam combines CEO fraud (where email attacks spoof the CEO and a high-risk employee) and W-2 phishing [...]