The contracts had identical code designed to sweep ETH automatically.

Ethereum contracts deployed using the EIP-7702 feature introduced in the Pectra upgrade have been exploited to function as sweepers that automatically transfer incoming ETH from compromised wallets to addresses controlled by attackers.