I believe my Yahoo account was hit by this, since my sent mailbox showed messages with links similar to one I accidentally clicked (from a Gmail account!).
The comments in this thread suggest that the attackers now have my cookies. What can I do to invalidate old cookies for Yahoo mail?