Trapping fork/execve is probably overkill here. Since the user will often just type su or sudo, all that 'malware' needs to do is modify PATH