Phishing links get clicked a median 21 seconds after open, while inbox filters leave campaign infrastructure untouched.