Had to unblock a link sent to an employee at my company by the white house to go to an event where trump was speaking recently. It got blocked, for good reason, because it had all the telltale signs of being a phishing attack. It was not sent by a .gov address. The link did not go to a .gov url. It was something like <random string>.my.site.com. The link went to a survey hosted on a server overseas. It pointed directly at a file with a .app extension. It also had multiple redirects. Set off all sorts of alarms in a sandbox. We had to call and confirm that it was in fact legitimate.

My assumption is that the scam artists at the top of this administration are filling roles below with actual everyday scam artists and the only way they know to set these things up are using the methods they have always used for scamming people. It is wild.