Java is recognized to be the most popular programming language in the world. It is a portable object-oriented programming language that could be used in any platform. Its syntax is easy and similar to the C programming language. The Java virtual machine (JVM), its code-executing component, enables it to run on any platform. However, JVM is a prime target for cybercriminals because if its flaws. In Q1 2013, several Java vulnerabilities have been disclosed, some of took a while to be patched. Java vulnerabilities are known entry points used by exploit kits, which run on Windows machines. Other malware that used Java vulnerabilities also run on platforms, such as the Flashback malware that spread on Mac operating systems. In this presentation, we explore the Java programming language and its environment. In our exploration, we review the Java programs used by cybercriminals, and how these programs are used in exploiting the early vulnerabilities in Microsoft Virtual Machine�s Java bytecode verifier. We also review the latest methods used in exploiting Java. The review and discussion includes a list of exploit packs known to use Java vulnerabilities in spreading malware. In addition, we demonstrate how to analyze a malicious Java applet from one exploit kit to show its capabilities. To conclude the presentation, we provide recommendations to prevent infections from Java malware.