If it swaps the address, you know which one you entered. Compare that one with the one it tells you you entered. No external signer needed.
I assume the swap happens before signing. But if it happens after signing, this means the attacker can also sign, in which case they would just drain your wallet immediately.
the malware swaps the address. so when you sign without double-checking the address, you're actually signing a tx to the attacker. you're then broadcasting that tx like you would normally. that's how anything signed leaves the browser or wallet.
the details of my criticism depend on the UX of the target attacked by the payload. by my understanding, if the payload only detects and swaps addresses, then our entire discussion is the real scam, donating our sats to the rest of the community.
If it swaps the address, you know which one you entered. Compare that one with the one it tells you you entered. No external signer needed.
I assume the swap happens before signing. But if it happens after signing, this means the attacker can also sign, in which case they would just drain your wallet immediately.