That's my exact question. This requires getting a .so on a device, and setting an environment variable for all users. The malware itself isn't too interesting,

That's my exact question. This requires getting a .so on a device, and setting an environment variable for all users. The malware itself isn't too interesting, however clever they managed to hide it, but how they actually got it on the computers is.