That's already predicted from the start, they started to make anyone feel comfortable and try to believe in this shit scam airdrop token.
Then they were collecting the private key and during the airdrop and they are starting to check any private key that they have collected it from their phishing site.