You're supposed to spy on an organization's users and machines for the benefit of the organization that has contracted you. That's not what you're doing here. You've taken an adversarial relationship with your (potential) customer, acting to harm them.

Presumably legal, but morally gray.