There was just an article a month or so ago about how out of the top 500 sites in the US, like half of them had crypto mining software installed and they didn't even know for a while. In the few weeks that it was active on all the sites, it made a relatively small amount of money as well from what they said. Hackers attack the plugins and libraries that other websites use, because that is easier than attacking the sites individually.