Hackers' use of instant messaging networks to deliver malicious code has grown consistently from 2004 to the present, with the number of discrete attacks listed by the IM Security Center having grown 15% from 347 attacks in 2005 to 406 in 2006. Hackers use two methods of delivering malicious code through IM: delivery of virus, trojan, or spyware within an infected file, and the use of "socially engineered" text with a web address that entices the recipient to click on a URL that connects him or her to a website that then downloads malicious code. Viruses, worms, and trojans typically propagate by sending themselves rapidly through the infected user's buddy list. An effective attack using a "poison URL" may reach tens of thousands of people in minutes when each person's buddy list receives messages appearing to be from a trusted friend. The recipients click on the web address, and the entire cycle starts again. Infections may range from nuisance to criminal, and are becoming more sophisticated each year.