Most cloud providers have some provisions in their Terms of Service about mining/crypto/unfair use.
- On VPSs with shared capacities, the above-average CPU usages disadvantages users of other VPSs (Unfair use).
- Increased CPU usages uses more power, not only to power the CPU, but also for cooling in the datacenter. If a CPU uses 100 Watts, most of that energy is release as heat. For simplicity sake, I'll simply state that every Watt used needs to be evacuated as excess heat. So the increased power usage is caused by both the system and the cooling.
- A temperature increase inside the machine in a datacenter will have a shorter lifespan than one that does not have that increased temperature. It is generally accepted (and scientifically proven) that increased temperatures shortens the life expectancy of electronic equipment. The TCO (Total Cost Of Ownership) rises for a provider.
So several factors are involved for the cloud provider. I probably didn't cover them all. This is specifically why they put those provisions in their ToS. Some have higher priced plans that do not forbid mining, or even intense computing targeted plans. These plans will cover all the projected costs and sti
This is all on the cloud providers side. They have an agreement with a user (paid or otherwise) and they are responsible for detecting, preventing and stopping activities that violate their ToS. There are probably some legal implications on this, but that is for lawyers, not for me.
To gain a temporarily high hashrate (when the price is up, difficulty is down or blockrewards are high) there is a hashrate market place. It's called NiceHash. You offer a certain amount of funds for a specific amount of hashrate for a period of time and people will sell you the hashrate they produce with their own machines.
I think the key is here: paying. People are abusing cloud providers through hacked accounts, prepaid accounts opened with forged creditcard info (which are traded on certain places on the web), trial accounts etcetera.
These activities do not limit themselves to a single account or cloud VPS. Not seldom they use tens of thousands (I am not exaggerating) cloud instances, all mining to a single address, often many with the same workername. These instances are spun up with scripts on a revolving schedule. It is also why you you on some pools a very distinct wave pattern in the pools total hashrate.