Flare, a leader of Threat Exposure Management, has released research titled The Phishing Kits Economy in Cybercrime Markets, which uncovered how modern phishing has evolved into a mature, service-driven underground economy.
Findings showed that combo kits, which are built to impersonate entire clusters of services in one deployment, are the engine of modern phishing. Flare found 43.8% of entries leveraged these prepackaged sets of phishing tools and resources to scale with one kit meaning many victims and many monetisation paths.
Based on analysis of more than 8,600 underground, Deep Web, Dark Web and messaging platform discussions, Flare’s report reveals how phishing kits and Phishing-as-a-Service (PhaaS) platforms are engineered for scale, speed and monetisation, allowing even low-skill actors to bypass multi-factor authentication (MFA), steal sessions and take over accounts with alarming efficiency.
The report shows that modern phishing operations are no longer constrained by geography, language or technical expertise. Kits are built in one region, sold in another and deployed globally, often within hours.
“Phishing often appears chaotic, but when campaigns are conducted at scale, they follow clear structures and economic incentives,” said Assaf Morag, Cybersecurity Researcher at Flare. “When you analyse enough activity, you can see which approaches consistently succeed, which ones fail and how attackers refine their operations over time, providing insights defenders can actually act on.”
