i'm still waiting for malware to propagate by a shortened url that goes to a legitimate site, builds up credibility (retweeted, etc.) and then is swapped out on

i'm still waiting for malware to propagate by a shortened url that goes to a legitimate site, builds up credibility (retweeted, etc.) and then is swapped out on the shortening site to start redirecting to a different page that looks like the original but does some drive-by download or exploits a zero-day vulnerability. there would be hundreds of inbound links pointing to it coming from trusted sources, and could even use a legitimate shortener like bit.ly but just make the bit.ly link direct to some other shortener that nobody would notice (because the browser redirection would happen so quickly), then do the switch at that second shortener.