This happened to me with the Triada virus, on a Nomu S10 - it came with factory ota. That one patched the Zygote process and became invisible and unremovable without reflashing.