My passphrase. Not a single one or a mandatory connection with the hardware device.
Condoras, these recent wallet drainer scams, don't even need the seeds or private keys. Once you grant the website access to your wallet by entering the passphrase. That is enough for the scammer to drain your wallet. I don't know what kind of program or bot they use, but it works like magic.
There have been quite a number of article for such wallet drainer scams in the Beginners and help board. They range from malicious websites and fake tokens that can drain your wallet once you try to transfer them out by connecting to a specified website.