Malware masquerades as patch for Java