Where do threat actors get the email addresses for phishing attacks?

They steal them:

Email marketing firm hacked to steal crypto-focused mailing lists (bleepingcomputer.com)

Email marketing firms are prime targets.

Please Note:

I am on leave so the news this week is “in brief”. You can still contact me via the contact page and Octagon Technology.