You don't gain much from having root or kernel level access if you're just sending spam from a machine running an OS that isn't typically checking for malware.

You don't gain much from having root or kernel level access if you're just sending spam from a machine running an OS that isn't typically checking for malware. Windows is a much more attractive target because you can also get user's bank and credit card details, but doing that entirely in userspace will get you picked up by the (now fairly ubiquitous) malware scanners. There's a strong incentive to move yourself into the kernel there.