Approval phishing

It is the dominant vector on EVM chains because it does not steal the private key but abuses the allowance model of the ERC-20 and ERC-721 standards themselves. Spending someone else's tokens requires an approve followed by a transferFrom, and the attacker becomes the authorized spender. There are three variants: the on-chain signing of an approve or setApprovalForAll, often for an infinite amount; the off-chain signing of a permit (ERC-2612) or Permit2, a gasless EIP-712 message the attacker executes later; and a direct transfer disguised as another operation.

Why it matters for security hygiene. The damage concentrates in approvals the user forgot they had granted. Good practice is to review and revoke allowances with tools like Revoke.cash or Etherscan's Token Approvals panel, to prefer exact-amount approvals over infinite ones, and never to sign messages you do not understand, a risk made worse by blind signing. The same technical model applies everywhere, since the standard is global.