It hides the malware's trail, and disguises which keys were leaked, making rotation harder