Orkut worm hits 500,000 + users

Orkut Virus which uses the same technique as this Orkut worm created by Rodrigo Narrates

The Portuguese language attack exploited a vulnerability in Orkut's scrapbook feature to post malicious JavaScript code on a user's page.

The worm, which was reported yesterday by McAfee Avert Labs, had gained ground by spreading quickly from friend to friend.

The worm was transmitted when members received malicious scraps written in Portuguese. When translated to English, one scrap read, "2008 is coming. I wish that it begins quite well for you."
On viewing the scrapbook post, the code performed the exploit and downloaded a .js file to the user's machine.

The worm then took control of the user's account, sending out copies of itself to all of the user's friends and joining a group called 'Infectados pelo Vírus do Orkut', which translates as 'Infected by Orkut virus'.