Hi, OP here. Just wanted to add one point of technical clarification: it wasn't a RAT, it was a C++ app that used the QuickTime SDK to connect to the camera, OpenCV to run face detection, and curl to regularly send the results to a hacked-together PHP script that uploaded them to Tumblr. It sat in the dock while it was running, with a silver Apple logo as the icon.