A colleage of mine has just found his bank account cleared out - the thief logged on with his credentials and transfered money elsewhere, but the bank's logs show that it was done from a different IP address from his (his is static, so easy to spot). We're not sure how the details were obtained yet - looking now - but we're assuming something like:
http://news.bbc.co.uk/1/hi/technology/4173218.stm
The worrying thing is that he's not a numpty, but the kind of person who could reasonably think it "couldn't happen to him"; he's technically competent, and was running regularly-patched XP/SP2 and anti-virus, plus A-squared, spybot and MS anti-spyware. Nothing he runs spotted whatever did it. He was running Zone Labs Integrity Desktop (which I think is the corporate edition of Zone Alarm) but looking at the system logs it failed a couple of days ago - that's unusual, so i'm not sure if it was accidental or if it was taken out to stop an outbound warning appearing.
Anyway - heads up. If you're running XP/IE6 then it's worth being extra careful at the moment while the Anti-spyware lot catch up.