[SpookyZalost]

Linux also has it's own AV and is being increasingly targeted due to it's primary install base being servers.

the problem is it's difficult to get in and control linux like you can windows so a lot of attacks on linux servers are two fold, there's the payload of course but there's also a lot of social engineering which linux sys admins are actually being trained to recognize due to the increasing usage of it.