As always, hackers using malwares to mine monero, especially.
I thought in the past what if I can use a third party server (aws or others) to mine cryptocurrencies but apart from considering it personally as a theft, it can easily be busted with the high cpu usage :
AWS has automatic systems in place that makes it easy to detect and block a lot of attacks before going out of their infrastructure. AWS has clear terms of usage that enables it to quickly take action and shut down the machine in case of any misuse.