Suppose a hacker creates a Windows application that looks and feels like a legitimate web browser. The user believes they are using, say, Google Chrome. If you simply watched the bits going to and from the computer over the network, it would look like the user in fact was using a legitimate browser like Google Chrome.
However, on the client side, this fake browser records all keystrokes entered by the user, and from that data, deduces the user's website/password-manager passwords. In the background, this data is continuously transmitted to the hacker.
Alternatively, this fake browser could act like a legitimate browser for all URL's entered by the user except for some specific exceptions. Perhaps for a banking URL like chase.com, the browser does a phony DNS-resolution and serves up content from a different site owned by the hacker, fooling the user into entering login credentials or other sensitive info.
Are attacks like these possible? If not, what mechanisms are in place to thwart such attempts?
I tried googling for phrases like "fake browser hack" but have not found anything that seems to resemble this.