Companies should be aware of the most common types of phishing campaigns in order to tailor their security controls. Proper training for employees should be conducted, which includes teaching them that they should never use their company email to sign up for personal services that are not business-related, and to never re-use their corporate password to sign up for any other online service. Monitoring should also be in place to quickly identify threats in case an employee falls for a phishing campaign. Reporting processes should be defined so employees understand who to contact if they believe they were a victim of a phishing campaign.

https://www.bleepingcomputer.com/news/security/dhl-dethrones-microsoft-as-most-imitated-brand-in-phishing-attacks/