In reply to Daniel Garcia.

Unlikely as this would add one more layer of security to break. The browser would then have to trust the certificate offered by the malware host; this would not be cost-effective for the bad guys. Fewer security measures would trigger by keeping the exfiltration via HTTP.