[lsp]

There's also the potential to get the account blocked by google in the case of your rat getting a lot of installs in short time, thus lots of messages going out in short time. Or would this not count if emails are going to self? I dunno. Ignore me.

Bish0pQ makes the best point - hard coded creds are bad.

I'd consider another exfiltration method. Possibly a php script that does some checks on the client to make sure it's genuine before accepting its requests, you should compress and encrypt your exfil data before sending to your php base.

This has some redundancy in that you can upload the php to multiple places, if one fails the rat can go to the next one. Because data in encrypted, it's safe to do it on other peoples servers, just pick up the files from all servers and decrypt at home. To avoid leaving your unencypted data on other servers.

There's a lot of extra layers you could put into this. You might be excited to get your project off the ground and go live but it will all be for nothing if your data exfiltration method fails. Do it right the first time.