As phishing evolves, criminals switch to malware