A scammer publishes a fake wallet app or browser extension, often copying a popular real wallet's name, icon, and description closely enough to be mistaken for the genuine product in a search result.
Some versions simply steal the seed phrase you enter during setup. Others function as a real wallet on the surface but contain hidden code that quietly redirects transactions, or that waits until a meaningful balance has been deposited before draining it.
Because the app often looks and behaves like a legitimate wallet at first, victims may not realise anything is wrong until funds are already gone.