These have been out there awhile. Because of how long BTC addresses are folks are cutting and pasting (clipboard use) to go from one computer to another. Been writing papers about this in other places. Again, hardware wallets are the best and easiest solution. The good ones show the destination address on a screen (not the computer monitor) and when you sign/release ONLY the designated screen address can receive the funds. So, just saying the solutions are out there and quite easy. Really, lazy users make coin theft so darn easy. [ranting on soapbox]
AFAIK, malware that wants to monitor the clipboard first need to install a so called "clipboard hook", and this can be blocked with anti-loggers like SpyShelter.
This old ransomware has been revamped as Bitcoin-stealing malware Jigsaw appears to be back with new malicious intentions, with a simple-but-effective trick to go after crypto-currency. July 20, 2018 https://www.zdnet.com/article/this-old-ransomware-has-been-revamped-as-bitcoin-stealing-malware/