I think this is a normal thing now, - https://ambcrypto.com/2-3-million-bitcoin-btc-addresses-monitored-clipboard-hijacking-malware/