A phishing operation targeting MetaMask users has emerged using fake two-factor authentication alerts to steal wallet recovery phrases. The attack exploits professional branding and nearly identical domain names to deceive users into revealing their seed phrases, according to blockchain security firm SlowMist.
What Happened: Fake Security Alerts
Attackers send emails appearing to originate from MetaMask Support, announcing mandatory two-factor authentication requirements.
The messages include the MetaMask fox logo and color scheme.
SlowMist's Chief Security Officer documented the scam in a post on X, revealing attackers use domains differing by only a single letter from the official site.
Victims who click the links land on phishing sites designed to mimic legitimate security processes.
At the final stage, users are prompted to enter their seed phrase under the guise of completing "2FA security verification."
A seed phrase grants complete wallet access. Anyone obtaining it can transfer funds, recreate the wallet on another device, gain control over all associated private keys, and execute transactions independently—all without requiring passwords, two-factor authentication, or device approval.
Also Read: Trump Tokens Rally Following Venezuela Military Operation Saturday
Why It Matters: Resurgent Threats
The scam surfaces as cryptocurrency phishing losses dropped 83% to approximately $84 million in 2025, down from nearly $494 million in 2024.
"Phishing losses tracked closely with market activity. Q3 saw both the strongest ETH rally and the highest phishing losses ($31M). When markets are active, overall user activity increases, and a percentage fall victim—phishing operates as a probability function of user activity," Scam Sniffer's report stated.
Read Next: Aave Founder Pledges Revenue Sharing After 55% Vote Opposes Community Control