Alternatively, send them straight to a site that absolutely gets them put on some watchlist. Not as much instant karma as malware, but situationally more useful in the grand scheme of things. (Some kind of government honeypot perhaps, or just phish n’ dox them.)