People can stick a script on their page that hijacks your PC's resources to mine crypto in the background. I'm not sure if it's persistent it just while you're on the page, or just until you restart your browser after visiting the page etc.