Here's an interesting article on JavaScript hacks. This would apply to people going to web sites that have the attacks in the code when you download the page and the inability of various virus, malware and spybot type software figuring out that the code is actually malicious.
http://www.eweek.com/article2/0,1895,2115638,00.asp?kc=EWEWEMNL041907EP38A