I remember malware replacing addresses on the clipboard like this, probably 8-10 years ago, there were reddit threads about it at the time for anyone with energy to look.