According to Harpie,when users want to conduct gasless sales within the OpenSea platform, they are required to approve a signature request with an unreadable message. With this feature, users are also able to allowed to create private auctions with unreadable signatures.
Because of this, phishing websites have been using this feature to ask their victims to sign one of these unreadable messages. According to Harpie, the signatures often pose as a step required to log in and access the website
However, the login messages are actually signature requests to conduct a private sale of the victim’s NFTs to the scammer for 0 Ether (ETH). If signed, it will send the NFTs to the hacker’s wallet address