When I used to think about phishing, I mostly pictured an attacker creating a fake login page, sending a suspicious email, and hoping someone entered their password.
After reading Microsoft Threat Intelligence’s report on the infrastructure behind modern phishing campaigns, I think that picture is incomplete.
Modern phishing is becoming an organized industry. Attackers no longer need to build everything themselves. They can purchase phishing kits, compromised cloud infrastructure, domains, hosting, and other services from specialized providers.
That lowers the technical barrier for cybercrime and makes phishing much easier to perform at scale.
Cybercrime Has Its Own Supply Chain
One of the most interesting parts of Microsoft’s investigation was the relationship between different criminal groups.
Microsoft identified phishing-kit developers as well as an underground marketplace that supplied infrastructure to other attackers. Instead of one person handling every stage of an attack, different groups specialize in different parts of the operation.
Some develop phishing software. Others provide compromised cloud environments. Others purchase those services and use them against victims.
To me, this makes modern cybercrime look increasingly similar to a legitimate technology industry, except the products and services are being used for criminal activity.
This specialization matters because it allows attackers with relatively limited technical skill to gain access to sophisticated tools.
Scale Changes the Threat
Microsoft reported that the phishing kits it investigated helped facilitate more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
That number stood out to me.
A phishing message does not need an extremely high success rate when attackers can send enormous numbers of them. Even if only a very small percentage of people fall for the attack, the operation can still produce successful compromises.
This is why simply telling people to “be careful” is not enough.
User awareness is important, but organizations also need technical defenses that assume someone will eventually click the wrong link.
Legitimate Infrastructure Can Be Abused
Another part I found interesting is that attackers were not relying only on obviously malicious servers.
Microsoft found that criminals were using compromised or fraudulently obtained Microsoft and Google cloud environments as part of their infrastructure.
That creates a difficult problem for defenders.
Traffic coming from a well-known cloud provider may appear more trustworthy than traffic coming from an unknown server. Attackers can take advantage of that trust to make malicious activity appear more legitimate.
This reinforces an important cybersecurity principle: trust should not be based only on where something comes from.
Identity, behavior, permissions, and context also matter.
MFA Is Important, but It Is Not Magic
Modern phishing attacks can also target authentication systems themselves.
Microsoft describes techniques such as device-code phishing, where victims can be manipulated into authorizing an attacker-controlled session through a legitimate authentication process.
This shows why security cannot depend on a single defense.
Multi-factor authentication is still valuable, but organizations should also use phishing-resistant authentication, conditional access policies, limited privileges, monitoring, and strong identity controls.
Security works better in layers.
My Takeaway
My biggest takeaway is that phishing should no longer be viewed as a simple email scam.
It has developed into an ecosystem with developers, infrastructure providers, marketplaces, automation, customers, and specialized tools.
That changes how defenders need to think about the problem.
Stopping one phishing website may help temporarily, but the larger challenge is disrupting the infrastructure and business model that allows thousands of similar attacks to appear afterward.
For me, this also demonstrates why cybersecurity requires both technical defenses and an understanding of human behavior. Attackers are not only exploiting software vulnerabilities. They are exploiting trust.
As phishing becomes more automated and commercialized, defenders will need to make identity systems, authentication, and monitoring increasingly difficult to abuse.