Phishing attacks on increase as crimeware kits sold online

The number of phishing attacks and websites has surged to an all-time high thanks to the growing problem of 'crimeware' kits being sold online.

This was the warning from the Anti Phishing Working Group (APWG) , which said the kits allow non-technical criminals to start up their own online criminal empires.

All the information they need to set up phishing emails or websites infected with malware, such as Trojans, viruses and worms, is contained in the kits bought and sold online.

After people are either lured to a phishing website, or open a link that downloads malware to infect their PC, the criminals will steal personal details such as names, passwords and bank account details.

This DIY approach has helped fuel the rise in phishing attacks over the past year, said the APWG. The organisation, which released its Project: Crimeware report today, said the number of unique phishing attacks this June was nearly 13,500 more than in June 2005.

The number of unique phishing websites had also more than doubled from 4,380 in June 2005 to 9,255 this June.

"The kits allow non-technical criminals to infect websites with malicious exploit code with the intent of running it upon users visiting a website," said Dan Hubbard, vice-president of security for Websense which carried out the research for the APWG .

"We have seen the most password-stealing malicious-code URLs tracked to date. We attribute this to the advancement of monetary gain that is being made by utilising crimeware applications and websites.

This is also attributed to the increased use of exploit kits being sold and bought on the internet," he continued.

APWG's news comes days after another security organisation Messagelabs warned that cyber criminals were increasingly getting close and personal.

Its August 2006 global malware report said phishing attacks are increasingly aping customer or victim relationship management techniques of legitimate businesses.

"The latest wave of phishing attacks uses social engineering techniques by harvesting personal data from social networking sites such as Myspace," said Mark Sunner, chief technical officer at Messagelabs.

"You will be sent an email personally addressed to you from your bank with your correct address and postcode," he explained.