SecureList, a Kaspersky owned website, recently published a report stating that up to 1.65 Million computers may be unknowingly mining cryptocurrencies. According to SecureList, the most popular methods of deploying the miners is via known exploits such as EternalBlue and also by Adware.
The most popular currencies are currencies that 1) offer privacy and 2) work well being mined via CPUs. Currently those two currencies are Monero and ZCash. One Monero address being used for the payment address, when entered into the pool it was mining to, shows a total payout of 2,289 XMR.
The article goes into much more detail on the ins and outs so check it out at SecureList.