I'd call it malware behaviour, but I agree with your general point.