That was my first impression too, since the SSH-key installation attempts are much more frequent and tend to dominate the feed.
I did find at least one campaign that went further: it tried to fetch `http://41.216.189.157/run.sh` with wget or curl, execute it, and remove the script afterward. The downloader referenced payloads for aarch64, i386, loongarch64, and m68k, so it appears to be targeting a fairly broad set of Linux systems.
I haven't fully analyzed the artifacts yet, so I can't say exactly what service or payload it ultimately installs. But it was definitely doing more than adding a key.
This also exposed a weakness in the current UI: repetitive persistence attempts are prominent, while rarer download and execution chains are easy to miss.
I did find at least one campaign that went further: it tried to fetch `http://41.216.189.157/run.sh` with wget or curl, execute it, and remove the script afterward. The downloader referenced payloads for aarch64, i386, loongarch64, and m68k, so it appears to be targeting a fairly broad set of Linux systems.
I haven't fully analyzed the artifacts yet, so I can't say exactly what service or payload it ultimately installs. But it was definitely doing more than adding a key.
This also exposed a weakness in the current UI: repetitive persistence attempts are prominent, while rarer download and execution chains are easy to miss.