Yes: CSS can contain malware, though in my experience, its usually been tied to a vulnerability, e.g. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3971
CSS rules can actually contain JS code (supported by at least some browsers), so from that perspective CSS can be "as bad as" JS.
This SO answer might be helpful if you want more detail. https://stackoverflow.com/a/482088
There are two different types of issues with untrusted data:
- It can contain malicious code to be executed directly (malware)
- It can be crafted in such a way that it will cause your legitimate applications to behave erratically (exploit) and perform something bad (payload)
Besides this, "static" files that do not contain code can hurt a browser by containing (carefully chosen) bogus data that exploits the existence of a bug or a mistake (called vulnerability) in the browser. The way in which the browser will fail to process this bogus data will cause it to perform actions that the attacker is looking for. For instance, it might redirect the execution of the browser's code to some segment of the CSS file that contains machine instructions, instead of the normal browser code.
This sounds unlikely but actually a lot of attacks belong to this category. For instance JPEG and PNG libraries are occasionally targeted, because they are low-level code that is very widely used (by browsers and also other programs like your OS). Often, browsers will create specific processes with stripped down privileges for parsing files and rendering Web pages to reduce the risk associated with running such code.
The bad news is you can't do anything at all about this and are constantly exposed to danger on the Web. Your only help is to keep all your software up to date to reduce the attack surface.