The account hijacking begins with a spam message with a short link to an apparently harmless session of the reliable news channel MSNBC. The real link is not part of MSNBC, but a crafty domain composed of subdomains at hxxp://com-im9.net. The domain was registered in Ukraine on Jan 27 and is hosted in a data center in Nicosia, Cyprus. The second stage of the attack is focused on the Yahoo Developers Blog (developers.yahoo.com), which conveniently uses a buggy version of WordPress.”]
Source: https://www.bitdefender.com/blog/hotforsecurity/yahoo-accounts-hijacked-via-xss-type-attack/