What Permit signatures are
Permit and Permit2 let you approve token spending with an off-chain signature instead of an on-chain transaction. They save gas and improve UX on legitimate apps.
Why attackers abuse them
Because the approval is a signature, not a transaction, it never appears in your on-chain history. Victims often cannot see how access was granted, and the permission can be broad and long-lived.
Staying safe
Treat a Permit request as seriously as a transaction. Check the spender, the amount, and the deadline. If a new or untrusted site asks for a Permit on a valuable token, reject it.