i found a paper from an ethical hacker that took the time to exploit the RAT tool Poison Ivy. Through reverse engineering he found a vulnerability in the populair remote access trojan tool making it vulnerable for a reverse connection. This gives the infected computer the ability to connect back to the server and take over his computer.

paper:
http://www.signal11.eu/en/research/articles/targeted_2010.pdf

That's nothing new really. The "hacker underground" has been writing purposefully vulnerable exploits for some time now. It just goes to show you how important code review is! Hell, even Sony purposefully distributed malicious software!

Anyway, I remember reading "Hacking: The Next Generation" in chapter 7, there is an account of infiltrating a phishing group that had been distributing a phishing tool that had an obfuscated backdoor routine in it where all the people that clicked on the link actually sent the results back to the original author without the secondary phisher's knowlege as well as the secondary phisher.