Comment by grav

> Interestingly, the malware checks for the presence of Claude Code CLI or Gemini CLI on the system to offload much of the fingerprintable code to a prompt.

Can anyone explain this? Why is it an advantage?