They're getting Santa in on the act now, cheeky beggers.
The IM.GiftCom.All worm attempts to dupe IM users into thinking an acquaintance has sent them a link to a harmless Santa Claus file, but really installs a rootkit
[ZDNet]

Still, I persist that a lot of the responsibility lies with user education.