in my opinion it's a trick that hackers often call phishing, which is usually by changing the MyEtherWallet web address with a site that is "similar" to the original site created by hackers, and when wallet users enter their private key will automatically be listed in the hacker storage, somehow it can be like that, but my friend is often fooled by fake websites and then his wallet is hacked.