The most serious malware threat are rootkits. A rootkit replaces certain components of the operating system to make itself invisible. For example, if the ls command is replaced, it can make other files in a malware package invisible. For the same reason, if ps and top are replaced, it can make running processes of a malware package invisible.
Generally speaking, a rootkit replaces a multitude of CLI commands and service daemons (programs that run in the background providing services). Even critical drivers can be replaced when a rootkit is installed.