Organised criminal hackers are waging a highly sophisticated war by exploiting vulnerabilities in end users' web browsers using drive-by downloads, security experts warn.

The extent of the threat was exposed in a recent Google Online Security Blog post and the 2007 Trend Statistics Report from IBM's X-Force.

"It has been 18 months since we started to identify web pages that infect vulnerable hosts via drive-by downloads, i.e. pages that attempt to exploit visitors by installing and running malware automatically," the Google blog stated yesterday.

"During that time we have investigated billions of URLs and found more than three million unique URLs on over 180,000 sites automatically installing malware."

Google's team also reported that around two per cent of malicious websites are delivering malware via advertising.

IBM reported recently that criminals are directly attacking web browsers in order to steal identities, gain access to online accounts and conduct other illicit activities.

Yuval Ben-Itzhak, chief technology officer at security firm Finjan, said: "Our research teams have already identified more and more criminal hackers using these techniques with a great success."