Fake AAVE Scam?

Pretty sure I got scammed somehow with a fake AAVE token/ad (txn 0x49dc6f919ba5890af961727a12eb966f90b2a8c6d4c757fd2fbefc0be0747cfb). Received these tokens that said to visit AAVE for an airdrop. Four days later, someone managed to convert all of the tokens in that wallet (aWETH, SAND, CRV, cvxCRV) into ETH and then send it out. I did not interact with/approve any contracts, although it is possible I visited the website. Are there exploits out there that can steal keys from MetaMask? I would never approve a contract that I wasn't intending to, and always adjust the approval amount to exactly what I plan to let it spend when I do. I have never given my seed words out. None of the transactions appear in my MetaMask client, but they do show up in tools like zapper.fi. Someone also seems to have signed an AAVE token spending contract at the same time (TXN 0xdc52211f41e72d2d24e6e2959103a39dcf93f57660a4d28a320216f33031a01f). My computer wasn't on at the time these transactions happened, so either someone suddenly got access to my private key, or there is some other exploit going on.