Why? It's seriously what they do. The user installs the malware, it goes to a normal looking web page checks the html comments and receives it's commands. On the face of it everything looks fine to the user but the malware knows then what to do.