Experts at the German security firm G-Data discovered a RAT dubbed IcoScript which receives commands from C&C via email services including Yahoo and Gmail. The malicious code is controlled by sending specially crafted emails containing coded instructions. The bad actors behind the Ico script have chosen this mode to communicate with webmail services because access to webmail doesnt trigger suspects for security teams of targeted organizations. Bad actors could improve Icoscript diversifying the sources of their command can control, making possible the malware accepting commands sent via any number of legitimate webmail providers.”]
Source: http://securityaffairs.co/wordpress/27336/malware/icoscript-rat-email.html