I'm confused. You say the wallet has been empty since 2022, and the phishing attack just happened a few days ago. Obviously the phishing attack can't go back in time two years to take your crypto in the past ;p
You say "That would be me, not them". So you already know the answer. So what is your confusion?
About the possibility that if it was emptied, it may have been done so in a technically sophisticated way that would not show any activity.
But I guess that would be silly if everything is recorded on the blockchain.