Sorry, but got to take a stab at the line...
"The trojan takes advantage of a vulnerability in an older version of Java"
Yes, it was older version of Java for other platforms, as they patched at the beginning of Feb, but Apple didnt release their new Java version until 2 days ago that fixed the problem, that is poor form. This goes back to my comment-
"the poor malware writers wait until the holes are published by the OS, App vendor, then write new malware on the expectation that 98% of the population wont patch quickly."