From ha.ckers.org:

I got this picture from a reader of the site. Apparently the reader was simply viewing Yahoo mail and poof, RougeIframe trojan. We are starting to see a lot more of this kind of stuff, but it’s really disappointing that third party ads are being displayed on otherwise sensitive apps (or at least I think most people feel they are sensitive).

Don’t think that webmail will keep you safe. Your browser is only as safe as the protection software you are running!