MetaMask Phishing Uses Fake 2FA to Steal Seed Phrases

A new phishing campaign targeting users of the popular cryptocurrency wallet MetaMask has emerged, using fake two-factor authentication prompts to trick victims into revealing their wallet recovery phrases, according to blockchain security firm SlowMist. The scam, first flagged publicly on January 5, 2026, impersonates official MetaMask communications to steal funds from Ethereum-based wallets and other compatible chains.

SlowMist's chief security officer, known online as 23pds, detailed the operation in a post on X, warning that attackers send emails mimicking MetaMask support messages. These emails claim that two-factor authentication, or 2FA, is now mandatory to prevent account lockouts and urge immediate action, often with subject lines like "2FA: Protect Your Wallet." The messages feature authentic-looking branding, including the MetaMask fox logo and color scheme, to build trust.

Clicking the included links directs users to fraudulent websites with domains that closely resemble the official MetaMask site, such as slight misspellings like "matamask." Once on the phishing page, victims encounter a simulated security interface complete with countdown timers and warnings about...