Malware with a strong command-and-control network will be able to change the merchant.

Additionally, this blacklisting effect can be used strategically to target business you don't like by using the malware to perform a false-flag attack.

They probably use the card number to buy stuff from legitimate online stores, e.g. gift cards, to ensure that the transaction is hard to reverse/they get to keep their "winnings" even if the CC company does a chargeback.