I don't think new laws are needed. If the malware poses as one thing and then does another this should (hopefully, IANAL) be covered by existing laws against cracking or computer fraud. I'm not proposing putting any Orwellian laws on the book, but simply see this as a case of the company abusing the users' computer systems and apply existing laws to it. To me this is entirely analogous to some bored "hacker" talking people into installing a trojan on their computer.

Since malice seems obvious and the operation is clearly a commercial one, I don't see how this being anywhere in a gray area.