I am starting to feel like there is some kind of a tool or software that hackers use to find out recently typed in words or something, the moment you type your recovery seed while connect online makes your wallet weak, I am sticking with writing down with a pen and I think you should too.
I knew that some have tools to let your copy paste be exchange to their address for wallet. I remember that some got stolen funds upon copying their receiving address and the exact address where changed upon copying to the fill blank page. This happened on ronin network and some complained about it, but obviously those users were being infected on sites they have been visited.