Security of Java takes a dangerous turn for the worse, experts say (ars technica)

It is useless... Successful attacks against Norwegian banks often involved malware that just replaced the HTML on the login page with own form that sends the login credentials to a remote server. There an operator manually enter the login information into own browser window and do the payment. Then, to confirm a payment, they tricked the user to enter an extra credentials claiming a security check.