A user installs the Bybit Wallet Chrome extension to manage Ethereum, BNB Chain, and Polygon assets. Within minutes, they receive a pop-up notification asking to approve a token swap or sign a contract interaction. The interface looks legitimate. The chain name matches. But the request originates not from a dApp the user initiated, but from…