Phishing attacks down in 2009

Spam-based phishing attacks declined noticeably during the first half of the year according to IBM. However, it's not all good news,  cyber-criminals may simply be shifting to other technologies said IBM in its semi-annual security threat report .

"The decline in phishing and increases in other areas (such as banking Trojans) indicate the attackers may be moving their resources to other methods to obtain the gains that phishing once achieved," is the explanation offered in the IBM Internet Security Systems 2009 Mid-Year Trend & Risk Report. It says Russia is the top country of origin for phishing e-mails, with 7.2 percent share, while China is the top hosting country for spam URLs.

In the first half of 2009, 55 percent of the new malware seen was Trojans, an increase of 9 percent over last year, said the report. Trojan malware, which includes components called downloaders and info-stealers, are mainly being used in the form of "public-available toolkits" that are "easy to use" by criminals, the report points out.

Phishing attacks may be down because criminals "are likely getting better results with Trojans," said Dan Holden, X-Force product manager at IBM's ISS division. "It's a return on investment issue for them."

The big picture is that the web is a "dangerous place," Holden noted. Criminals are exploiting software vulnerabilities to compromise sites with malicious code or simply taking advantage of the openness of public social-networking forums to place malicious code to go after victims.