Downvotes on this comment are probably missing the point (as I see it), which is that redirect/browser/other HTTP hijacking malware is pretty common and could cause something weird like this.