Attacks are actively exploiting a zero-day ActiveX vulnerability in RealPlayer, researchers warned today.