Phishing sites and malicious approvals
Phishing dApps clone a real protocol's interface almost exactly, differing only in a domain that's off by a character, a different top-level domain, or a homoglyph substitution. Because the interface looks identical, the only reliable defense is checking the actual URL bar every time, not the page content, and only ever navigating to dApps through bookmarks you set yourself, never through links in DMs, ads, or search results, since scammers routinely buy top search ad placement for exact protocol names.
Malicious approval transactions are more insidious because they don't steal funds immediately. An ERC-20 token's approve function can grant a spender contract permission to move a specific, or literally unlimited, amount of that token from your wallet, at any point in the future, without any further signature from you. A phishing site or a fake 'claim your airdrop' page tricks you into signing an approval for a malicious contract instead of a legitimate transfer. Nothing visibly happens immediately; the attacker drains the approved tokens later, often once multiple wallets have accumulated enough approvals to make the sweep worthwhile, which is exactly why victims rarely connect the theft back to the signature that caused it.