according to the Globe:
The first wave of infections were linked to a fraudulent pop-up prompt users received on websites to install a new version of Adobe Flash. Later, hackers identified a security hole in the Java platform that allowed users to get infected without clicking on anything at all.

Here’s what you need to know. (the first two are most important)

How to protect your Mac from Java based malware

How to disable java on your Mac web browser

Java for Mac OS X 10.6 Update 7

Java for OS X Lion 2012-002