In the latter case, the malicious code acts as a kind of proxy on behalf of
the attacker, to cause the software to operate in a manner that is inconsistent
with its specification and its users’ expectations, but which achieves some
objective of the attacker who originally planted or delivered the malicious code.