I’m thinking similarly. Seems delightful for malware development and exfil. But I haven’t confirmed how the actual connections are made.