The malware uses a Python script to retrieve commands and code entered into the draft field, and then it can respond in Gmail drafts and can include the data it wants to steal.