A self-styled security researcher has created a tool called Twittor that uses Twitter Direct Messages as a botnet command-and-control server.