Sure, but once you start registering companies to run your shady schemes, you're in the process of transforming from a bad bad actor to a legitimate bad actor. Stop trying to steal bank credentials, and switch your spyware to pulling things that help to target ads, "optimize for engagement", or "streamline business", and suddenly the entire system starts working for you. You can then work in the clear, and use all the new security tools - like HSTS, DoH, certificate pinning, and code signing - to prevent your victims from protecting themselves from you.