I do know some companies pay to occasionally phish their own employees. I think (hope) it’s mainly used for training. But I wouldn’t be surprised if there are teams dedicated to this sort of effort. Would it be illegal?
My company does for training. In this case though they would be targeting someone who is taking action to be bad, as opposed to someone who might make a mistake.