Comment by hctaw

Carrying out an attack for personal gain is malicious. It doesn't matter if the payload is for crypto mining, creating a backdoor for the NSA, or a vulnerability you can cite in a paper.

Pentesting unwitting participants is malicious, and in many cases illegal.