So essentially, you need to make a malware that activates the agents instead of users doing that, which is likely not to be classified as a malware since there may be legit reasons to do that. And then you can use that agent to get your actual malware in. Sounds horrible overall.