The first thing I have done to make sure this is not a crazy browser exploit was:

document.onmousemove = console.log

No console logs until I really move the mouse.

Then I opened Chrome DevTools and checked what resources are loaded on the network tab, once I saw this, I figured the trick:

https://www.attejuvonen.fi/mouse/arrow_m.png

Since I'm on Ubuntu like the author, the moust indeed seems like my original one. This is a fun one :)