I'm curious if anyone is tracking transactions against the wallet addresses in the malicious code - I assume that is essentially the attackers' return on investment here.

Just ran a script to do this – doesn't seem like there's much going in, other than one test transaction.