Probably should just link to the security researcher's post, since it's far more informative:

https://doublepulsar.com/adform-compromised-to-serve-crypto-...

The bitcoin wallet swap thing that these malware scripts often push, how effective is it? It just seems so niche, if I'm doing stuff with my crypto wallet, I'm more likely to do it from my phone where I wont be copying and pasting to and from a web browser, maybe a webview if anything? I always double check the characters match up anyway... I am just shocked the level of effort for the most niche hack.