It appears that the micro SD card that shipped with a Vodafone-branded HTC Magic (same model as the ht-03a) contained the mariposa and conflicker bot net clients, as well as a password logger. This would not affect the phone itself, only a susceptible windows machine onto which the SD card is mounted, much like an infected USB stick.
Yikes. This is happening all too often these days. Sigh. As far as the mac is concerned, the only threats in the wild require the users to do something insanely stupid like download warez or a special "codec"for viewing p0rn and give root privilege to the installer. But I have a feeling this won't be the case much longer.