The phishing group -- named Avalanche by security researchers because of the large quantity of attacks it generates -- was blamed for more than 84,000 out of the nearly 127,000 phishing attacks tracked by the Anti-Phishing Working Group (APWG), an organization of companies and law enforcement agencies that tracks phishing activity in its semi-annual reports.

Avalanche has used slick automated tools to crank out phishing attacks quickly, setting up fake Web sites and then spamming potential victims with e-mail messages designed to trick them into typing in their usernames and passwords.

The group has targeted about 40 institutions, including major U.S. and U.K. banks as well as online providers such as Yahoo and Google, said Greg Aaron, director of domain security with Internet infrastructure vendor Afilias, one of the authors of the report. "They were able to ramp up and they became very, very large," he said.

Spurred by this activity, the overall number of phishing attacks more than doubled in the last half of 2009 over the first half of the year.

Avalanche first popped up in late 2008, not long after the previous top phishing threat, Rock Phish, dropped off the scene. In fact, some antiphishing experts believe that Avalanche is simply the next generation of phishing tools designed by Rock Phish's creators. Researchers believe that Avalanche, like Rock Phish, is run out of an Eastern European country.