Overheard - The role of ActiveX in browser exploits

Because so many ActiveX controls turn out to be malicious, Microsoft designed Internet Explorer 7 so that it displays a warning every time a site attempts to use an ActiveX control. The problem is that the casual user does not typically understand what an ActiveX control is, or what the consequences of allowing an ActiveX control to run might be. Brian Posey, ActiveX security improves with Internet Explorer 8’s security features

Experts are predicting that there’s no end in sight for ActiveX exploits.  It makes sense — because even criminals want to be cost-efficient.  If you’re trying to find vulnerabilities to exploit, you to make sure you can affect the highest number of people — and IE is still #1.