Maybe it looks for a certain browser string and hides itself otherwise? I knew of Wordpress malware from last year that would never show to logged in users.