I think the recent Flashback.K qualifies to some degree. All you had to do is visit an infected webpage and the Java applet would walk onto your system. It would immediately ask for admin privileges, but due to the huge Java hole it would have your user privs automatically.
Since OSX enabled Java by default, and since responsible practices were no defense, this compromised enough Macs that it was proportionally comparable to the Conficker infection on Windows.
http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb...