Hackers are exploiting a vulnerability in a Yahoo website to hijack the email accounts of Yahoo users. The attack begins with users receiving a spam email with their name in the subject line and a short “check out this page” message. In the background, a piece of JavaScript code exploits a cross-site scripting vulnerability in the Yahoo Developer Network (YDN) Blog site in order to steal the visitor’s Yahoo session cookie. The cookie is then used to access the user’s email account and send the spam email to all of their contacts.”]