Most of the time people fall for phising websites that look like the original, connect their wallet and approve a malicious transaction without paying much attention, because they trust the site they think they are on. That or they fall victim to some sort of “prize” they won that takes you to a malicious site where you have to connect and then approve a transaction that is supposed to give you your prize but doesn’t. Can’t really be masked, user should be able to see what the tx is doing on the chain before accepting.

Getting your wallet drained by just clicking a link is highly unlikely and the only scenario I could think of is a malicious javascript executing in the background and trying to find any seeds stored in plain text. But that would require it passing through browser script blockers, browser warnings, antiviruses and OS dialogs like UAC.

What are the reasons institutional investors prefer SOL over others?

Solana is by far the sole number one token in terms of speed and bandwidth. And with Firedancer this will increase tenfold. Big companies that want to actually use blockchain technology and scale their web 2 applications are just looking for what works best. VISA recently announced a partnership for example.

All in all some of it is probably just speculation. Solana is one of the few top 10 coins that has a great upside potential since it was oversold and there is great room for improvement market cap wise.