I'm still waiting for the Teeth of the Tiger shopping-mall attacks. We saw what happened in Kenya recently. Just imagine that in several malls across the US.
After 9/11 we actually got pretty good at keeping terrorists from getting to the United States, so I don't think attacks like these are a particularly likely occurrence. First you've got to get enough committed people here to carry out the attacks, which means you have to find people that aren't already on the radar of American intelligence, then get them through the Visa process. Once they're here you've got to obtain all the weaponry you'll need, because you're sure as hell not bringing it here in your checked baggage, so now you've got to deal with the American criminal element (not exactly the most trustworthy lot) to get your hands on a cache of firearms and explosives, all while remaining off the radar of law enforcement. It's really not as easy as it sounds when you open those technothrillers....
Even if you pulled it off, I doubt you could duplicate what we saw in Kenya or Mumbai. American law enforcement isn't likely to shrink from the confrontation like some of the Mumbai police did. They're well armed and well trained for these sorts of things. You've also got a non-zero chance of running into armed civilians and private security, depending on your choice of targets. I doubt the average civilian concealed carrier or rent-a-cop could stop a committed assault, but they've got a decent chance at taking one or more bad guys out with them, so that's yet another thing that could go wrong from the perspective of the would be attackers.
I suppose you could worry about domestic terrorists doing the same, because they're already here and would have an easier time arming themselves. Of course, shooting up a shopping mall doesn't seem like their style, and the Government is fairly adept at infiltrating these types of organizations before they can pull off anything serious.