Drainers are sold as a service to scammers. They hide behind fake mints, airdrops and copies of real apps, and ask for approvals or "permit" signatures that hand over your tokens.
If a site asks you to sign something you don't understand, close it. A separate "burner" wallet for new sites limits the damage.