Malicious software can send data through the Payload channel (if implemented). [1]
Standard/references: [2] [3]
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.