Malwarebytes has identified the use of pop-under windows which contain a cryptomining script to bypass adblockers and continue to run even after the user has closed the visible browser windows.
https://www.notebookcheck.net/New-cryptomining-exploit-continues-to-use-your-resources-even-after-the-browser-window-is-closed.267662.0.html