Wednesday, as tech-savvy crooks increasingly took up the tools of the hacker trade to steal consumers' personal and financial identities. According to the monthly report from the Anti-Phishing Working Group (AWPG), a consortium of more than 1,000 firms, including a majority of the top U.S. banks and ISPs, November saw yet another increase in the number of phishing Web sites spotted. During November, the group detected 1,518 scam sites, a 29 percent increase over October, and another record for the year.

Worse news than the boost in scamming sites -- which are often "hit-and-run" Web sites that stay up only an average of 6 days -- is the AWPG's analysis of an increase in the use of malicious code by phishers to steal credit card and bank account accessthat asks for personal information, which is captured by the bad guys and could be used for identity theft and other problems. The messages were first spotted in Israel by security vendor Fortinet Inc., which reported Friday morning that security appliances at its customer sites had recorded 46,000 hits by the phishing wave. Based on the number of attacks and the speed at which they're spreading, Fortinet said this phishing attack ranked in the top 10 of all time. Fortinet said it recorded 12,000 hits in the first two hours after the first one was detected Thursday evening. "On a scale of 1 to 10 on creativity, this one is high up on fooling users," says Patrick Nolan, virus researcher at Fortinet. "But after the first click, it