A Scroll of Spellstealing can be found in any of three states: Discharged, Spellstealing, and Spellstolen. It can be either a Greater Scroll of Spellstealing that harms the spell book, or a Lesser one that merely copies from it.
When there is a spell on it, it can be used to cast that spell normally or transfer the spell to a wizard's spell book. This clears the stored as usual but unlike a conventional scroll, this does not destroy the scroll, instead it returns to the Discharged state.
Each Scroll of Spellstealing has a way of being recharged from the
Discharged state to the Spellstealing state, and will show the required
ritual in magical text when discharged. Examples range from simple -
cast a Detect Magic, a Read Magic, a Read Languages, and a Knock
targetting the Scroll, to the complex and dangerous - 2D6 HP of blood
from a summoned demon and the caster each have to be sacrificed in an hour long ritual consuming 200 GP plus the cost of the demon summoning.
In the Spellstealing state, a permanent spell upon the scroll can be read, targetting any spell book within 60 feet of the caster. This power takes time and the scroll must stay within 60 feet of the spell book for three full rounds in order to hack into the spell book and copy a random spell from it. The scroll user is using the "read scroll" action in the first round, and can take other actions in the following two rounds, while staying in range.
If the target spell book is in the possession of its wizard, the wizard will get a save vs magic to resist the effect after the first round, and might then get a spellcraft check (or a roll of 1-3 on a D6 in OSR games) to discern what the threat was that needed resisting, especially useful in the case of failed resistance. Successful understanding would allow other defensive measures. If the spell book is removed from the range of the scroll too soon or the power is resisted or otherwise interrupted by an effect like a Dispel Magic cast at it or the imposition of an Antimagic Shell, the scroll becomes Discharged and its user must save by rolling higher than the level of spell it was stealing on a D20 or the Scroll of Spellstealing is destroyed by the interrupted magical transmission. Save again in the case of destruction or the destruction is a violent burst of colorful magic side effects doing 1D6 damage per level of spell it was stealing in a radius of 5 feet per level of spell, Save vs Magic/Will Save/Wis Save depending on the edition to avoid damage, or a roll on the random magical effects table of the DM's choice in place of the raw damage.
There are two versions, the Lesser Scroll of Spellstealing copies the spell from a spell book, leaving the spell book unharmed. The Greater Scroll of Spellstealing transfers the spell from the spell book, leaving behind a blank page, gibberish, an annoying message like "Thy Grimoire hast been Haxxored", or a subtly damaged version of the original spell that will backfire with a random magical effect on the caster if memorized and used, depending on the whim and effort expended by the creator in its crafting. The Lesser Scroll is thus more subtle and can be used to get an extra casting of a spell from your own spell book, while the Greater Scroll of Spellstealing is a weapon that will drive a targeted wizard to fits of anger and despair and a deep desire for vengeance. Greater Scroll is not much use to capture a spell from a wizard's own spell book, outside of a dire emergency, since it deletes the spell from the spell book and it would have to be used to restore the spell to the book or cast it and lose it permanently.
The easier the charging ritual is, the more expensive and valuable the scroll is. Greater Scrolls will have more difficult and expensive charging rituals than lesser scrolls.