The XMRig miner was disguised as an image and hosted on compromised cloud storage (Alibaba Object Storage Service). This enabled the attackers to maintain low detection rates.