Maybe once a rogue memo is discovered (containing a malicious link) the front-ends could flag the memo in the wallet feed.

So something like this: Received from accountname

Would become something like this: Received from accountname Hacking Attempt

Or something along those lines.