Record numbers of criminals are using malware designed to steal confidential data, the Anti-Phishing Working Group (APWG) has warned. 

The latest analysis from the organisation found 3,350 URLs in May dedicated to spreading so-called crime-ware, including password-stealers and key-loggers.

The figures represent a 9.5 per cent increase on April, and a 7.4 per cent increase from the previous record in February.

Much of the monthly increase is due to attacks targeting the ANI vulnerability, according Dan Hubbard, vice president of security research at Websense. 

"A large number of these sites were from a regional attack in Asia that compromised several sites and planted exploit code," he said.

Analyst firm Frost & Sullivan reported similar findings last week, suggesting that a for-profit malware boom had led to 16 per cent growth in the market for antivirus software. 

There was some positive news, however. The APWG figures showed a drop in overall phishing reports to 23,415, its lowest since September 2006.

The study also found that criminals are registering fewer new URLs for the purpose of defeating blacklists.

The APWG found that the number of unique phishing URLs had dropped by more than 40 per cent from last month's high of more than 55,000.