So, this morning I received an email saying I received an Orkut scrap from a friend with contents “Bom Sabado”. It turns out that it’s a typical case of Cross-Site Scripting (XSS), the attacker can inject and execute its script from hxxp://tptools.org/worm.js and the contents of scrap are able to by-pass Orkut sanitization. The same Scrap is automatically posted to all friends Automatically joins a set of communities it seems visiting one of these communities is sufficient to get infected, with community IDs 106698808, 6, 558494, 106698628, 106691341