Sunday's New York Times article, Viruses That Leave Victims Red in the Facebook, highlights the epidemic that is targeting online social networks with malicious links that hijack victims' accounts.
Personal story: Some months ago, I received a Facebook notification for a "Graffiti" sent to me by a relatively obscure friend of mine. When I clicked on it, it prompted me to allow access to the application, which was suspicious enough since I already had Facebook Graffiti.
The moment I allowed it access, I discovered that the application was sending my friends notifications about a fake graffiti I drew for them too. I immediately removed the application and posted a "Facebook status of shame." I was able to alert a few friends who had actually clicked on the notification they received from me. The fake-graffiti spam application was pulled within the hour by Facebook.
Further Reading:
One Of The 32 Million With A RockYou Account? You May Want To Change All Your Passwords. Like Now. (techcrunch.com)