I'm more interested in the delivery technique to be honest
Thus far, delivery has been done through the following:

1) SPIM (Instant message spam) i.e. Hey, take a look at this pic! <link>
2) SPAM Various banking and online payment links to look at new changes to the agreement.
3) Wireless "seeding". This is very new. What they're doing is wardriving for access points, getting a DHCP lease, then passing the payload to open fileshares and/or through old RPC exploits. Out of all of the methods, this is the one that has me worried the most. There are other implications of using this method that were found that I cannot release publically - yet.

--TH13