IIRC one of Monero's design goals is that it isn't easily GPU/ASIC-mineable, so CPU mining is competitive. It's also designed to be difficult to trace.

Both of these properties make it a relatively safe and profitable avenue for malware authors.