It wasn’t a person—it was his server. All eight cores of his Ryzen processor spiked to 100%. His phone buzzed. Client emails: “Site down.” “Error 500.” “Why is my homepage showing Russian dating ads?”

The worst part? The hacker wasn’t even malicious for money. In the final terminal message before Marco wiped the drives, he saw: "You tried to steal $45. I just stole your future. Fair trade? – Nulled." Marco sat in the dark, the smell of burnt thermal paste in the air. He had saved $135 over three months. It cost him his business, his reputation, and a potential expulsion hearing.

For three weeks, everything was perfect. His profit margin soared. He slept like a king.

It was the most expensive $49.99 he’d ever spent. Because it reminded him, every single month, of the price of a single click.

Marco logged into WHM. His heart stopped.

He tried to click "Fix Permissions." Nothing. He tried to SSH in. Denied.

Marco, against every screaming neuron of common sense, did it. The script executed in three seconds. A green banner flashed: His heart sang. No more ramen for dinner. He closed his laptop, triumphant.

Marco, a broke college student running a small hosting reseller business from his dorm room, stared at the screen. His legitimate cPanel license cost $45 a month—a fortune when his only clients were his roommate’s blog and a local pizzeria’s broken menu site. His finger hovered over the mouse.

The email arrived on a Tuesday, its subject line a siren’s song:

By noon, Marco’s phone was a fire alarm of fury. His upstream provider terminated his account for "abuse originating from your IP." His name appeared on a public blocklist for spam. The college IT department knocked on his door—someone had used his server to attack the university’s mainframe.

The cPanel interface looked wrong . The logo had been replaced with a crude skull icon. The menu items were scrambled. Instead of "Email Accounts," there was "Crypto Miner Controller." Instead of "Backup," there was "Send All Data to Endpoint."

One click.

The pizzeria called at 8 AM. Then the roommate. Then his landlord, whose real estate site was also hosted.