What a modern phishing kit actually costs to run

A kit that works costs less than most people assume. The infrastructure is the cheap part: a domain nobody will look at twice, a certificate, a reverse proxy, a template scraped from the real login page in an afternoon.

The expensive part is patience. Sending on a Tuesday morning to forty people, not four thousand. Matching the sender to a real internal thread. Waiting a week between waves so the reports do not cluster.

Cost is not the control that stops this. Attention is.