Thanks for the link, it will be helpful, as current time is of airdrops, new airdrops are keep coming especially the ones of inscription but to be honest as an active airdrop joiner, till now I did not face any issues maybe that's because I don't have enough funds to withdraw or make a transaction (like to pay the gas fee).
Well, I don't have any technical idea of how these scammers work but if they also have to pay a fee to make tx then do not keep any in your wallet, and I think to track the incoming and outgoing transactions we should set a tracker which would give us notifications, so when scammer have to withdraw funds from our wallet, he might have to manage for funds first so incoming or outgoing tx's notification could help us.
But what should be the first step for us after knowing that we are being hacked? As we can't change the phrase or key? we can't act faster than hacker in most of the cases.