>>7Java in a browser is only used for Java drive-by attacks. Java as a web technology was abandoned years ago due to the prevalence of Java-based malware.
https://en.wikipedia.org/wiki/Drive-by_downloadActionScript is used in Flash. Flash is also used for ransomware.
https://www.theregister.co.uk/2018/03/27/exploit_kit_decline/Basically, you'd pay someone on the dark web for a Flash 0-day tool called an "exploit kit" or EK, and it would allow you to break out of the Flash sandbox and get code execution, so you could deliver a keylogger, ransomware, RAT, etc. But ransomware payloads were the most common because of the simplicity and profitability. Botnets and spyware are more complicated and not as profitable.
In the case of both Java applets and Flash, their decline is due to security problems, largely due to memory management problems that lead to breaking out of the sandbox that was supposed to contain them.
JavaScript can be used for cryptocurrency mining and browser locker scams, but it's nothing compared to the capabilities of Java and Flash, which can do arbitrary code execution when coupled with the right exploits.