Users who remain vulnerable to an ActiveX photo uploader vulnerability used on many websites are now being targeted in active attacks, researchers from Symantec said today.

Earlier this month, Symantec warned of a critical bug in an image uploader plug-in made by software development company Aurigma and distributed by many of the popular social networking sites --  including MySpace and Facebook -- to enable the addition of photos.

On Friday, researchers said they first noticed in-the-wild attacks taking advantage of the vulnerability, which has been patched, said Kevin Haley, director of product management for Symantec Security Response.

Under the attack scenario, individuals receive phishing emails that direct them to a bogus MySpace login page, Haley told SCMagazineUS.com today. Once there, the malicious sites search victims' computers to learn if they are vulnerable to the image uploader issue. If they are, the site attempts to install a medley of trojans.

“It's a double whammy,” he said. “It's going to try to steal your credentials [MySpace username and password] and it's going to try to download some malware on your machine.”

An Aurigma representative did not respond to a request for comment.

If users are not running the Aurigma software – or if their PCs are pached for the flaw – the sites will look for other vulnerabilities, including a recently disclosed Yahoo Jukebox ActiveX flaw.

Haley said businesses might consider disabling ActiveX on their browsers, but ideally they should ensure their machines are running the latest fixes.

“Once the patches are available, you need to get them out,” he said. “The bad guys and the malware writers are where the users are, and today that's the social networks.”