From the screenshots they are collecting the information from browser addon wallets which are usually less secure hot wallets.