US financial services faced nearly 40,000 phishing URLs in just six months as free hosting, AI tools, and Omegatech expanded attackers' infrastructure options.