After logging in to the website for 10s, the user's wallet is emptied, the hacker hijacks the DNS server, and the user logs in to MyEtherWallet to force a redirect to the malicious website. The user was forced to redirect to a malicious website when logging in to MyEtherWallet.