A phishing scheme exploiting the EIP-7702 mechanism has been identified, targeting wallets with leaked private keys. Attackers set up the EIP-7702 exploit on compromised wallet addresses, which automatically diverts any gas fees used in attempts to transfer remaining tokens, such as $WLFI in Lockbox contracts. A potential countermeasure involves using flashbots to execute a three-step process within a single block: injecting gas, canceling or replacing the EIP-7702 setup, and transferring the valuable tokens. However, security firm SlowMist does not offer frontrunning services, suggesting affected users contact specialists like @0xAA_Science or @BoxMrChen for assistance. The initial breach involves the leakage of private keys.