Malicious code can be hidden in video streamed or downloaded from websites such as YouTube or songs streamed from social-networking websites including MySpace, iSEC researcher David Thiel demonstrated at a Black Hat gathering of computer protection professionals in Las Vegas.