On Tuesday, September 21 a cross-site scripting (XSS) vulnerability in Twitter became publicly known and was exploited by attackers, as well as many curious copycats with non-malicious intentions. An issue surrounding the parsing of attributes of posted links allowed JavaScript code to be executed whenever a user hovered over a link with the mouse. According to Twitter, the vulnerability had been patched a month ago, but resurfaced with a recent code change. Some users started to misuse the vulnerability as a new feature, adding things like rainbow-colored text boxes or harmless pop-up boxes to their tweets.
It comes as no surprise that this vulnerability was also used for malicious purposes. You can’t really blame users for getting infected, as they didn’t even click on the suspicious links. Rolling over any of the specially crafted links was sufficient to start the embedded...