Hundreds of websites are harbouring malicious code that uses visitors’ computers to generate digital cash, suggests a report.