Quote:
They are hitting email providers

Not exactly, from my understanding, they were targeting Verizon email addresses. Yes, they are embedding the first part of the email address in the body of the email, with a hyperlink, and it appears to be coming from an individual. Until you look at the header you don't know it is from the eku.com. You probably didn't see the images because your computer picked it up as spam and did not load them.

I'll probably end up running the accounts through Google.