Subscription-based phishing packages make it easier for bad actors to trick people into giving up logins or sensitive information.