We had a MacDefender window pop up on my wife, running Safari with popups blocked and click-to-flash installed as she was viewing a familiar hotmail page. It gave the message that everyone has been paraphrasing, you are infected, etc... and had very slick graphics and fonts going on. Not quite "Mac-y" but close enough for a new user perhaps. It gave 2 options, to download the scanning software or cancel, which is what she did. The malware still began to download a string of 5 or 6 windows and unix suffixed files. Trying to close the window was not working at this point, so I forced Safari to quit and tossed the files.
Best advise to a new Safari user is to disable the auto-opening of "safe" downloaded files.
Interesting show of interest in the mac user base from the hacker community! I'd be curious about the numbers of people who were lured.