According to Odaily, SlowMist's Cosine shared on the X platform that the new EIP-7702 mechanism is being exploited by cryptocurrency theft groups, rather than phishing groups. This mechanism facilitates the automatic transfer of funds from wallet addresses with leaked private keys or mnemonic phrases. Over 97% of EIP-7702 delegations have been authorized to these theft contracts.