[kbanman]

I personally witnessed two instances of this attack as early as December 8. I couldn't figure out until now how it was done.

[mrb]

How did you "witness" them? Were they doing js popups from yahoo.com?