It’s not necessarily malware. There are services that are pretty upfront and pay cash money for residential US bandwidth. That said, naive people might be surprised when their IP starts getting blocked.

e.g. https://www.honeygain.com/ (something like 100GB = $20).