Jameson Lopp explained that attackers generate Bitcoin addresses matching the first and last characters of legitimate user addresses to deceive users

Quotes that support claims

According to Lopp's Feb 6 article, the threat actors generate BTC addresses that match the first and last digits of addresses from the victim's transaction history. Lopp analyzed the Bitcoin blockchain history for this type of attack and found:

An an address poisoning attack, an attacker sends its target a transaction from a newly-generated wallet whose first and last characters match the target wallet, or a wallet the target has recently interacted with. The next time the target wants to send money to that wallet, they might mistakenly copy the lookalike address from their transaction history and send money directly to the hacker instead of their intended recipient.