[mNovak]

It's just plain and simple phishing -- the user still has to authorize the transaction, nothing gets stolen just for visiting the site or connecting the wallet.

Not to say it's the user's fault entirely. What they're taking advantage of, is that generally people are less familiar with what to look for in a crypto transaction vs say an online credit card form (and/or wallet UI is worse than a typical stripe checkout)