This question was marked as answered wehen I was notified about it. But after pondering for a few days, I decided to add my $.02
It is very convenient to subscribe to other sites with common authentication services accounts, using Faceboook, twitter, etc. account.
But how many ever read what they are permitting to those sites?
Here is very common warning, you cannot refuse from it without cancelling your subscription altogether, I've plagiarized from Gail Gardner. Woah! Read Those Twitter Authorizations Carefully posted 2 years ago:
The users themselves authorize to post from their accounts.
Well, and if this warning was not shown at all?
And if scammers have placed on web an attractive external service for antispam protection?
The sites install plugins to free 3d-party services and voilà, the site is protected and its visitor computers exposed to external services interactions while the latter does not even pass through "protected" site. No need for vulgar phishing or malware.
Just to note that most free plugins give access not specifically to protected site but to browsers and computers of its visitors, and they are mostly based on trusting to upload executable scripts into them. In other words, to stealthily control visitors computers without the risk of exposing this activity (through phishing or malware/viruses patterns detection). Just to stress again that malware detection is being and can only be done by checking the communication between user's computer and a visited site while the sites, by installing plugins, give access to 3d-party servers from IP-addresses different both from those of protected site, of visitor and even of website on which webmaster subscribed for free external service (which plugin s/he installed).
This makes impossible to detect any wrongdoings.
According to FTC (US Federal trade Commission) Report from March 2005:
adware aptly illustrates the challenges associated with developing a
workable definition of spyware. Adware is often bundled with other
software programs, which are frequently provided to consumers for free
And again according to FTC,
"Spyware" is mostly classified into four types: system monitors,
trojans, adware, and tracking cookies
A little bit off-topic of compromising user's accounts but it still important to note that in order to webscrape visitor's sensitive information (his eMail, name, etc.) from his computer, there is no need for a visitor to interact with the site but just to visit it (and interaction mostly lead to even compromising its computer and accounts).
Another thing is that those who do it are not interested to expose and be detected by vulgar malicious activities.
And obviously nobody is interested to honestly describe you these common secrets. Especially because just advertising, or even spamming, is less lucrative than webscraping, datamining, webharvesting and selling personal data and webtracking internet users. Webmasters are happy that they do not need to clean their websites from spam, the providers of antispam protections have peaks of demand when spam or SEO blackhat tools make new releases, etc.