This reminds me of something similar I did about 5 years ago: https://blog.securem.eu/projects/2015/03/08/flooding-the-phi...
One important thing is to report the phishing attempt, both to the hosting providers involved and to the mail service used to send the emails.