This reminds me of blue boxing; the initial decoy https connection is the equivalent of dialing an 800 number, during which the switch is commandeered with the proper tones and the hacker can dial out to wherever he wants. to the telco it looks like he just made a 3 hour call to an 800.
Beyond an approach based on steganography and on obfuscating the traffic, re-using and extending the work developed to harden botnet command and control channels would seem a good model for robust communications.