Hacker News Reader

Dunno how stealthy this is given that masses of base-64 garbage you didn't put into a crontab seems like a pretty big red flag.

I think the idea is that various Linux endpoint protection products don't look there.

That seems like an obvious oversight. This is a well known and widely used malware technique. https://attack.mitre.org/techniques/T1053/003/

When's the last time you checked yours, before this story?