This seems very similar to yesterday's article about North Korea running similar shenanigans via LinkedIn[0]. Probably good to make it the norm to run these things in a VM. I doubt this requires running on a completely different host yet, given the simplicity of the code.

[0] Analyzing North Korean Malware | https://news.ycombinator.com/item?id=42516568