According to SlowMist’s @evilcos, the largest users of Ethereum's new mechanism, EIP-7702, are coin theft gangs (not phishing groups). EIP-7702 allows the automatic transfer of funds from wallets with leaked private keys or seed phrases through authorizations, with over 97% of EIP-7702 delegations pointing to coin theft contracts.