The OP lacks details explaining the question. According to my analysis, the scenario is like this (correct if you have another opinion):

First, the attacker steals your address's private key. (This is how he gets your token.) This is impossible.

Second, the attacker creates a transaction that transfers all of your tokens to his own address, which is similar to yours. (The attacker has now taken your token without giving you anything in return.)

In the third, the attacker sends a transaction of 0 tokens from your address to his own address. (This is what makes it look like you sent the token to the scammer yourself.)