Now that this has been disclosed, one of the affected websites that has not been listed is: http://www.themoscowtimes.com/ http://www.themoscowtimes.com/. I was

Now that this has been disclosed, one of the affected websites that has not been listed is: http://www.themoscowtimes.com/ http://www.themoscowtimes.com/. I was a victim of the exploit myself, so if you have visited that website before August 8, you might have been as well. The attempt to load a PDF was visible in the browser in 2 ways. 1.) Displaying a message that the PDF may not be displayed correctly, which looked like this: https://support.cdn.mozilla.net/media/uploads/images/2013-03-01-15-26-09-2f3711.png https://support.cdn.mozilla.net/media/uploads/images/2013-03... except for the PDF of course, because it was loaded in a hidden iframe. 2.) In my case the exploit tried to open one of my public keys (with the .pub file extension) but because the browser determined this was an executable file (because of the mime-type) that should not be displayed by the browser it triggered a file dialog asking me to open the file with some other program. This is what alarmed me and that way I discovered this 0-day. I must say however that other versions of the exploit have surfaced that do no longer target the public key file (maybe for this reason?) so the file theft may not be noticed.