I have read the following:
Gene is working on his laptop with several tabs open in his browser. He unlocks his MetaMask wallet to make a transaction. An attacker uses the open tabs to see that Gene is using MetaMask.
The attacker sends Gene a pop-up message saying that his transaction has failed. This happens sometimes, so Gene isn’t worried. He enters his password to remake the transaction. The attacker now has access to Gene’s wallet.
I quite don't get how an attacker uses the open tabs to see that Gene is using Metamask.
I'd appreciate it if you explain this a little bit further.