Users who remain vulnerable to an ActiveX photo uploader vulnerability used on many websites are now being targeted in active attacks, researchers from Symantec said today.