Not every cybercriminal needs to build a phishing operation from scratch.
Criminal marketplaces can provide infrastructure, templates and services that make attacks easier to conduct.
This model is often described as phishing-as-a-service.
The practical consequence is scale. More criminals can launch convincing campaigns without having to develop every technical component themselves.
For users, that means phishing messages can arrive more frequently and can look increasingly professional.
The defence remains the same: verify unexpected requests, avoid entering credentials through unsolicited links and use phishing-resistant authentication where possible.
The existence of criminal services makes basic security hygiene more important, not less.