Modern Phishing as a Service Is Boring (And That Is Why It Works)

4 MIN READ

The phishing email that lands in the inbox in 2026 does not look like a phishing email. It looks like a Salesforce notification, an HR benefits update, a DocuSign envelope the user was expecting. The clever typo in the sender address, the obvious sketchy site, the rest of the picture the defender has been trained to spot, those are now the markers of the lazy phishing operation, and the lazy phishing operation is the one that gets filtered.

What replaced the clever phishing sits as a service stack. The dedicated SMTP provider, the warmed up lookalike domain, the phishing kit that clones the Microsoft 365 login and ships the session cookie to the operator, the credential harvester that pulls the contact list and the email history before the user notices anything, the residential proxy that makes the session look normal. The whole thing costs between 50 and 500 dollars a month, depending on the target, and the operation that runs it does not need to know how any of it works. The defender has been optimising for the clever attack. The attacker has been optimising for the boring one. That gap is why the click rate has not moved in five years.

What the operation actually looks like

Five components, every one of them available as a service. Email infrastructure runs as a dedicated SMTP provider plus a lookalike domain warmed up with a few weeks of benign traffic. The phishing email passes SPF, DKIM, and DMARC, because the domain was set up specifically to pass those checks. The phishing kit runs as a website the user lands on when they click, cloning the login page of the target brand, capturing the credentials, performing the MFA bypass, and forwarding the session cookie to the operator. The credential harvester logs into the captured account, pulls the contacts and the email history, and packages the data for the initial access broker to sell downstream. The launder routes the session cookie through a residential proxy so the operator’s login looks like a normal user on a normal device. The operator runs as the only piece the attacker actually operates, and the operator’s only job amounts to targeting. The technical work has been outsourced. The user runs as the entry point. The credential runs as the product.

Why the technical controls miss it

Three places the technical controls look the wrong way. Email authentication sits at the top of the list. The phishing domain passes SPF, DKIM, and DMARC, because the domain was set up for that. URL filtering comes next. The phishing URL sits on a domain too new to be categorised, and the categorisation lands 6 to 24 hours after the campaign peaks. By then the damage has been done. Endpoint detection rounds out the trio. The phishing landing page sits behind HTTPS, the credentials are submitted over the same HTTPS connection, and the endpoint sees a user logging in to a domain. It does not see a credential being stolen.

The technical controls catch the lazy phishing. The well funded phishing walks past them, every time, because the well funded phishing has been designed to walk past them.

What actually works

Phishing resistant MFA sits as the move that closes the gap. FIDO2 keys, passkeys, certificate based authentication. The credential the user submits cannot be phished, because the credential does not exist until the user proves physical presence. The user with a FIDO2 key cannot lose their credential to a phishing kit, no matter how convincing the kit runs.

Then the inbox warning. The banner that says this email came from outside the organisation, the banner that says this email matches a known phishing pattern. The warning does not catch everything. It catches the user who is not paying attention, which counts as most of them, and the warning does it at the moment the click would have happened.

Then the user training that looks like a red team simulation rather than a compliance video. Real phishing templates, real bait, real consequences, a real chance to fail in a sandbox. The training that pretends the user will not click does nothing. The training that lets the user fail safely sits as the training that moves the click rate.

The bottom line

FIDO2 keys, inbox warnings, realistic user training. The modern phishing attack runs as boring. The defence has to be boring too, and consistent, and applied to every user in the organisation. The defender who treats phishing as a clever technical problem will keep losing. The defender who treats phishing as a service economy problem has a chance.

By the Human Required Editorial Desk · Reviewed by a human editor · Rewrite draft