> What an analyst might miss though is that the seemingly-innocuous 'tox' covertly drops another ELF file directly in memory—a sign commonly associated with "fileless malware."

Yeah I agree, but since the whole essay is pretty much a sales pitch for their product, that's to be expected.

Also first-stage dropper are almost always heavyly obfuscated to avoid detection. There isn't anything novel about this and the second-stage malware actually has reasonable detection rates.