The attacker sends 0 tokens from your address without your private keys. The address is very similar that you send tokens to. Then a user copies address and accidentally sends tokens to scammer.
Here you can see 20 such 0 token transactions.
https://bscscan.com/tx/0x8af45041085d513da6c5acb06bc82acf108ccc08d7ae3a2b7dbe4671c2d75d70
Well first of all thank you for the warning and the heads up. I am not really sure though how this transaction attack would work. As others in this thread have already said, there should be no way that a scammer can send tokens from your wallet if he does not have access to your wallet which means to your private key and if he would have access to it then he definitely would not send 0 token transactions first. He would instead just send all of the funds from your wallet to a wallet that he is controlling. So i don't think that this scam works as you said, but i also don't now how it could work any other way. This kind of scam would be new to me.