Most of them are just script pretending mining and use old users funds to pay new ones as simple as that.