F-Secure has information regarding a cross-site scripting worm spreading in Twitter profiles for several hours last night. Twitter users started reporting that their profile had sent Twitter messages without their knowledge. Messages looked like this:
Many users thought the ‘tweets’ were legitimate communications from trusted friends and clicked on the link to ’stalk daily’. That caused more users to receive the bogus message.
If you are interested in more technical details, check out this blog entry: