user78: Is the threat of Botnets using massive amounts of CPUs/GPUs to mine Bitcoin, or some CPU-friendly coin, purely theoretical at this point? Or have there been reports of this actually happening?
I know of trojans stealing Bitcoin wallets, this is not related to my question.

user105: There were a number of news articles in September 2011 about the rootkit TDL4 using the Ufasoft GPU miner to mine bitcoins. A few links:

World's most dangerous botnet mines Bitcoins - The Inquirer
TDL4 Worms Discovered in Bitcoin Pools: Trend Micro - spamfighter.com
New worm turns PCs into Bitcoin miners - GMA News

Quotes below are from the article in the Inquirer:

SECURITY RESEARCHERS at Russian antivirus vendor Kaspersky Lab warn
  that TDSS, one of the most dangerous and widespread family of
  rootkits, recently received an update that forces infected computers
  to mine Bitcoins.
TDSS rootkits have consistently grown in sophistication since first
  appearing in 2008. The latest version known as TDL4 installs itself in
  the master boot record (MBR) and is capable of infecting all Windows
  versions, including 64-bit Windows Vista and Windows 7, which require
  signed device drivers.
[...]
It turns out that the variant had been configured to execute a
  component called conhost.exe with special parameters. Further
  investigation revealed that conhost.exe was a copy of the Ufasoft GPU
  Bitcoin miner application.


user108: First report about mining botnet was made at the end of June, and it evolved rapidly from CPU to GPU mining. But there is no consensus about what kind of harm it will do to Bitcoin, because from the bitcoin network point of view, infected computers run legitimate mining that supports network operation.

17 Jun 2011 - Symantec suggested that it would be profitable to
run CPU mining botnet.
28 Jun 2011 - Kaspersky Lab's expert Alex Gostev made first
report about simple CPU mining botnet found in the wild.
2 Aug 2011  - F-Secure reported about discovery of advanced CPU
mining botnet controlled via twitter.
11 Aug 2011 - Symantec discovered first GPU mining botnet called
Trojan.Badminer.


78: <p>Is the threat of Botnets using massive amounts of CPUs/GPUs to mine Bitcoin, or some CPU-friendly coin, purely theoretical at this point? Or have there been reports of this actually happening?</p>

<p>I know of trojans stealing Bitcoin wallets, this is not related to my question.</p>
 105: <p>There were a number of news articles in September 2011 about the rootkit TDL4 using the Ufasoft GPU miner to mine bitcoins. A few links:</p>

<ul>
<li><a href="http://www.theinquirer.net/inquirer/news/2109599/worlds-dangerous-botnet-mines-bitcoins">World's most dangerous botnet mines Bitcoins</a> - The Inquirer</li>
<li><a href="http://www.spamfighter.com/News-16865-TDL4-Worms-Discovered-in-Bitcoin-Pools-Trend-Micro.htm">TDL4 Worms Discovered in Bitcoin Pools: Trend Micro</a> - spamfighter.com</li>
<li><a href="http://www.gmanews.tv/story/233799/technology/new-worm-turns-pcs-into-bitcoin-miners">New worm turns PCs into Bitcoin miners</a> - GMA News</li>
</ul>

<p>Quotes below are from the article in the Inquirer:</p>

<blockquote>
  <p>SECURITY RESEARCHERS at Russian antivirus vendor Kaspersky Lab warn
  that TDSS, one of the most dangerous and widespread family of
  rootkits, recently received an update that forces infected computers
  to mine Bitcoins.</p>
  
  <p>TDSS rootkits have consistently grown in sophistication since first
  appearing in 2008. The latest version known as TDL4 installs itself in
  the master boot record (MBR) and is capable of infecting all Windows
  versions, including 64-bit Windows Vista and Windows 7, which require
  signed device drivers.</p>
  
  <p>[...]</p>
  
  <p>It turns out that the variant had been configured to execute a
  component called conhost.exe with special parameters. Further
  investigation revealed that conhost.exe was a copy of the Ufasoft GPU
  Bitcoin miner application.</p>
</blockquote>
 108: <p>First report about mining botnet was made at the end of June, and it evolved rapidly from CPU to GPU mining. But there is no consensus about what kind of harm it will do to Bitcoin, because from the bitcoin network point of view, infected computers run legitimate mining that supports network operation.</p>

<ul>
<li>17 Jun 2011 - <a href="http://www.symantec.com/connect/blogs/bitcoin-botnet-mining">Symantec suggested</a> that it would be profitable to
run CPU mining botnet.</li>
<li>28 Jun 2011 - Kaspersky Lab's expert Alex Gostev made <a href="http://www.securelist.com/en/blog/208188132/Gold_rush">first
report</a> about simple CPU mining botnet found in the wild.</li>
<li>2 Aug 2011  - <a href="http://www.f-secure.com/weblog/archives/00002207.html">F-Secure reported</a> about discovery of advanced CPU
mining botnet controlled via twitter.</li>
<li>11 Aug 2011 - <a href="http://www.symantec.com/connect/blogs/bitcoin-mining-trojanbadminer">Symantec discovered</a> first GPU mining botnet called
Trojan.Badminer.</li>
</ul>
