Spam and spyware still are profitable for cybercriminals, but the big money is in banking trojans and other web exploits, Cisco's annual security report has found.