nowadays, restricting outgoing connections initiated by unknown binaries should be a must. Specially if it's launched from /tmp

Lulu or Little Snitch should have warned the user and stopped the exfiltration of data.