A rather shady business used them early on and intensively at that. The porn industry. Yes, maybe you do not think it is shady or what ever - not my reasoning here.
And sometimes these businesses/business models set at the borders of our societies' conventions (or beyond them) are the first to kick in true adaption.
Yes, it not new - there have been many incidents - yet, it is new to me and reminded me, that adaption sometimes kicks in not only with the "early adopters", but with certain industries we tend to oversee.
The cybersecurity company proofpoint has just released a report, about mining malware -
that is where the malware "only" wants the resources of your computer - not any data or hijacking of your machine.
The malware called Adylkuzz (TROJ_COINMINER.WN) seems to exploit the same weakness as the heavily reported WannaCry virus that hit so many computers (note: They were only "hit" because they were not updated; its the poor controller driven IT strategies & ops that our corps think are so smart that made this possible).
But instead of using this exploit to take control of the machine or encrypting files on it - it installs a miner for Monero (XMR; a digital currency more opaque than bitcoin) and lets it run and produce Moneros - a lot of them, actually. And sends these to an address.
And that's how this ingenious person/group make 1,000 to 1,500 Moneros a day (not known is the number of infected machines) on one Monero address.
Today (23rd of May, 2017, 1831 CET), 1,000 Moneros are worth $43,560