A phishing attack has resulted in the theft of $6.28 million worth of stETH and aEthWBTC. The attack exploited offline permit signatures, tricking victims into authorizing transactions without incurring any gas fees. Victims reported that they merely clicked on wallet signature confirmations, unaware that they were enabling the transfer of their assets.