Normally if you want two transactions to execute sequentially in quick proximity, you could publish them both to the mempool at the same time with sequential nonces. The miners would then include them in nonce order, possibly in the same block.
The confounding factor here is that the transactions you want to be sequential aren't coming from the same account, and the second transaction is not executable until the first transaction completes, so it won't be accepted into the mempool since it's not executable until the first transaction completes.
Now, you might have some luck using an intermediate contract. The scammer is likely watching the mempool for funding transactions, and acting quickly as those transactions confirm. If you sent your transaction to a contract and the contract forwarded funds to the address in question, they're probably not going to identify the transaction until it hits their account, in which case you might have a little bit more time to get your transaction out and confirmed.
But keep in mind that the scammer can afford higher gas fees than you can, since they're trying to send whatever ETH is leftover after fees while you're trying to do a more gas-intensive contract transaction. Whatever gas price you can offer given the balance of the account, they can outbid so the miner will include their transaction instead.
Ultimately, your best bet is probably to get a miner to help you. For that, I'd recommend looking into Flashbots. You can assemble a transaction bundle with three transactions.
Transaction 1: Sends ETH to the scam address. This transaction should include 0 priority miner fee, so the miner has no incentive to include it without the rest of the bundle.
Transaction 2: Sends tokens to the destination address. Again, use a 0 priority miner fee so the miner won't include this without the whole bundle.
Transaction 3: Call a smart contract that confirms transaction 2 completed successfully, then sends ETH to the block.coinbase address for miner fees. Again, use a 0 priority miner fee so that the miner can't get paid unless the contract executes successfully.
This ensures that a miner has incentive to include all three transactions or none of the transactions, because the only get paid if all three transactions execute successfully. The only risk here is if the miner who picks up your transaction bundle is the scammer, as they could take your transaction 1 then sign their own version of transaction 2 to take your funds. The odds of that are pretty small though, as even if the scammer is an acting miner it's unlikely they'd get the next block after you sent this bundle.
