The end doesn’t justify the means. It’s unethical and illegal too. If you want to catch software pirates, you have to abide by the law, else you’re a criminal yourself too and therefore, on the same level of the pirate you are trying to catch.
Thousands of legit customers could have had their bank account or other highly sensitive credentials stolen.
Those customers paid 150$ to have a malware executable written to their disk, thus creating a severe security risk to their data.
In addition of that, passwords were transmitted over a non secure HTTP connection, that means pretty much any attacker on the network could read them.
Go pay 100$ to a company which write malwares into your hard drive, I won’t.