1 article on this topic.
The attacker sends you a worthless transaction from an address that resembles one you use. Weeks later you copy the wrong one from your own transaction list.