A truely malicious version of this would install a bot/rootkit on the victim's computer instead of just spawning a shell.