I'm not positive about this but keylogger actions have been picked up by anti-virus before. You might be able to decrease the chance you're caught as well by using this method. And what the other comment below me said about copying and pasting wallet details. This is actually an interesting attack against password manager usage. There are a lot of websites I use that autofill doesn't work correctly.

Virtually no one manually types in a wallet address. You copy/paste it.

> Once inside, the malware executed a malicious script that starts an infinite loop to capture a user’s clipboard data—with the goal of redirecting all potential cryptocurrency transactions to their wallet address.

Sounds like they were replacing the pasted addresses with their own when you paste it in the "transfer currency to..." fields.