How it works
Clipboard-hijacking malware watches your clipboard for anything that looks like a crypto address and swaps it for the attacker address the instant you copy. You paste, you send, the funds are gone.
Why it is hard to notice
The swap happens between copy and paste. Unless you compare the pasted address to the original, everything looks normal.
How to defend
Always verify the first and last characters of a pasted address before sending. Send a small test amount for large transfers. Keep your device clean of unknown software and use wallets that display the full destination clearly.