It's very common for malware to use services like this:

1) To host secondary payloads

2) To exfiltrate user data

3) In some cases even to coordinate commands to payloads