Ethereum

A little while ago I sent 0.5 ETH from a cold storage wallet on my Ledger to my hot wallet on Metamask.

After sending the 0.5 ETH I noticed this transaction in my cold storage wallet for a scam ERC20 token that I didn't create:

Scam TX

Here is the TXID for it: https://etherscan.io/tx/0xe30f58fe6f93a67499bb9b37cd9fe7643b1a4c2ccda6a66f1a1fb58ff64f001f

It sent the scam ERC20 token to a address that looks similar to the address that I had sent the 0.5 ETH to. The first few characters and the last few characters are the same, but the middle is different.

When I first noticed this transaction I freaked out for a minute because I thought someone had access to my cold storage wallet. Then I calmed down after I thought things through, but I want to be sure I have this right.

At some point a scammer sent me a ERC20 token through a contract. That contract was set to send the scam ERC20 token to a address that looks like a address that I send actual ETH to. Do I have that right? Am I correct in thinking that my cold storage wallet is still secure?

I am not 100% sure what the end goal of this scam is. Are they hoping that I copy the address that they sent the scam tokens to and send actual funds there?