Script-based attacks that cycle through multiple exploits and target trusted websites, increasingly sophisticated botnets, and cyberespionage that uses phishing to steal terabytes of data head SANS Institute's Top 10 list of 2008 security menaces.