Phishing sites are making the private auction feature look like a way to log in, luring victims to give up their NFTs unknowingly.