Perhaps the malware will sit idle like a "sleeper" agent until activated, and you want to reduce the chance of preemptive detection. Having its background poll

Perhaps the malware will sit idle like a "sleeper" agent until activated, and you want to reduce the chance of preemptive detection. Having its background polling look like a typical Twitter user agent would help it remain hidden and ensure that its command channel is not blocked. (At least for a large class of victims who do not have severe network restrictions in effect.) You could also send the destination address via Twitter, so that the malware does not leak information about the controller ahead of its activation or so that the controller can make last minute arrangements of temporary resources...