It’s easy to hate spammers, but not if they are unwitting victims of cybercrime, like those affected by the recently discovered Mumblehard malware.

ESET researchers first raised awareness about the Mumblehard malware on their blog, We Live Security. The Linux-built malware consists of a back door and a spamming daemon that sends large batches of junk email content. The team reports the botnet has been quietly running on infected machines for more than five years and has doubled in size over the last six months.

The revelations of this security risk could be a blow to the open source community, which has already been reeling from major flaws like 2014’s Heartbleed and Shellshock bugs. As DecryptedTech noted, there has long been a perception among IT professionals that Linux, BSD and similar platforms are more secure than their proprietary counterparts. As more Mumblehard malware is uncovered, that perception may change radically.

In fact, Ars Technica likened Mumblehard malware to Windigo, a spam botnet that was also discovered by ESET researchers and reportedly connected to thousands of Linux servers to spread unsolicited messages. In this case, though, Mumblehard seems more sophisticated because the Perl script it’s based on is concealed in a low-level programming language known as a “packer.” That’s why it may have been running undetected for last half-decade.

Then there’s the rate of infection itself. Experts believe the Mumblehard malware isn’t constantly sending spam but operates more intermittently to avoid drawing attention to itself. According to Help Net Security, it also seems to be associated with Yellsoft, whose DirectMailer system allows customers to send anonymous email messages.

The designer of the Mumblehard malware has been keeping a close watch on platforms that offer easy access. In its coverage of the story, The Register said the botnet takes advantage of content management tools such as Joomla and WordPress, the latter of which has been riddled with security problems in recent months.

The real question, of course, is whether filling up inboxes with spam is the worst of what the Mumblehard malware has to offer or if it also steals data or breaks into admin controls of the machines it infects. Although it managed to stay under the radar for a long time, hopefully it won’t take nearly as long to clean up whatever damage it has caused.