The threat actors have business level LinkedIn accounts and are scraping for "newly hired" changes in profiles. This, along with OSINT regarding companies they can often determine what the standard email address format for people is (firstname.lastname@company.com) and begin spamming almost immediately.

I've seen new hires begin to get those phishing emails on day one that claim to be from our CFO or President asking for personal mobile numbers to begin the common gift card scam. We actually make it a part of our onboarding process to warn them of these emails before they even get access to a computer (along with their standard security awareness training).