If you nest your languages, you can do a remarkable amount in a data URI: here's a Javascript chess-playing app, and an unbounded supply of webpages exploring the Collatz Graph, respectively. I expect you could get a small phishing site (which pulled graphics, etc, from the real thing) done similarly, and there's no server to take down. Writing a viral data URI that mailed itself to your friends might be harder.
Slashdot Mirror
If you nest your languages, you can do a remarkable amount in a data URI: here's a Javascript chess-playing app, and an unbounded supply of webpages exploring the Collatz Graph, respectively. I expect you could get a small phishing site (which pulled graphics, etc, from the real thing) done similarly, and there's no server to take down. Writing a viral data URI that mailed itself to your friends might be harder.