Electrum released 4.8.3 on Oct 24 as a security update for a flaw rated high by the project. Electrum says some servers are performing this attack in the wild.

• How it works: Electrum is a light client that trusts its server for unconfirmed transactions. When you broadcast a transaction, a malicious server can hold it back and put a conflicting transaction in your history that sends the money to the attacker. The fake has invalid signatures, but older clients never checked.
• The trap: the fake shows as unconfirmed with roughly zero fee. If you use RBF to bump its fee, your wallet signs a valid version of it and pays the attacker.
• What was seen: two private reports (Oct 11 and Oct 18). In both, the attacker address was ground to match the last four characters of the real destination. One user bumped the fee and lost money.
• Fix: 4.8.3 verifies signatures on mempool transactions that spend your own inputs before adding them to history. It still does not validate incoming unconfirmed transactions.

Upgrade to 4.8.3. Until then, check every output address in full and every amount before signing anything, including fee bumps. Wallets connected only to a server you run yourself are not affected.