SilentCryptoMiner infects 2,000 users by posing as a restriction bypass tool, leveraging YouTube and Telegram for distribution.