Doesn't need to be malware, they just didn't read the contract what it was allowing. The real issue is if you're interacting with web3 the contract system just

Doesn't need to be malware, they just didn't read the contract what it was allowing. The real issue is if you're interacting with web3 the contract system just isn't very clear to the user what you're enabling it to do, it doesn't like pop up saying "You ok with allowing this website access to send these NFTs or currencies out of your wallet?" End of the day, having a wallet with $1M in it and opening random websites and pressing Agree Agree Agree is a sure fire way to have a wallet with $0M in it. Until these systems are better at alerting the user whats actually being allowed this will continue to happen.