I already wrote some proof of concept code that steals a user's balance if they're using the Windows client. You'd just have to distill it down to shellcode and include it as a payload in a 100% silent driveby browser exploit.

POC code for Linux/BSD would be trivial, too. I'm not sure about Mac, but there's probably a way to do it via automator or regular message passing.

As I've been saying for a while on the BTC forums, the wallets will be the main target, not the crypto.