MetaMask hit by new phishing attack disguised as mandatory 2FA

Key points:

• A phishing campaign targets MetaMask users under the guise of mandatory 2FA verification.
• Victims are redirected to fake websites with an interface nearly identical to MetaMask.
• By entering their seed phrase, users hand over full access to their funds.

Security firm SlowMist has warned of a new wave of phishing attacks targeting MetaMask users. The attack typically begins with an email or notification claiming that two-factor authentication must be enabled. The message mimics MetaMask branding and uses language about “enhanced security.”

Source: X.com

The link in the message leads to a spoofed domain that closely resembles the official site. Attackers rely on look-alike addresses — such as mertamask instead of metamask — to reduce the chance of detection.

Hackers have built a market for reselling stolen crypto data

Prices depend on the balance, age of the account, and 2FA protection.

Читать дальше

How the scheme works

After clicking the link, users are taken to a page that imitates a security check and CAPTCHA. They are then shown a seemingly “official” MetaMask interface with a step-by-step 2FA setup, including a QR code and a confirmation screen indicating successful activation.

The final step prompts users to enter their seed phrase, allegedly to complete the security setup. At that point, victims effectively grant scammers full control over their wallets.

Source: X.com

The attack does not rely on malware or browser exploits. Instead, users complete all actions themselves, believing the process to be legitimate. The fake site even simulates a checksum verification of the seed phrase, creating an illusion of technical authenticity.

According to SlowMist, these phishing pages often remain active only briefly and rotate domains frequently, making takedowns more difficult.

Source: X.com

Previously, independent blockchain investigator ZachXBT reported uncovering a chain of digital asset thefts totaling roughly $2 million. He said the attacker posed as a customer support agent for Coinbase, linking multiple incidents through on-chain fund movements and activity in social media and private Telegram chats where the stolen funds were openly showcased.