Anyone have a clue on the attack vector? A reddit post said that the presence of the "/Library/Application Support/JavaW" indicates an infected system. Flash? Java?
Perhaps some kind of pirated Minecraft client is the vector? Java is needed, mods to that area are probably ignored, and the malware is connecting to a Reddit Minecraft forum which is something that is almost certainly not blocked by the victim if they're a player/fan.