A phishing campaign impersonating MetaMask security checks is spreading through fake 2FA pages that try to trick users into handing over their seed phrases. A SlowMist security expert said the scam is being pushed through misleading links and fake security notifications that appear legitimate at first glance. The goal is simple: create urgency, force quick action, and get users to surrender wallet access on their own.
Urgent warnings and countdown timers are central to the scam
The attack usually starts with a message claiming a MetaMask wallet is at risk. Users are told they must complete two-factor authentication immediately to protect their funds. The fake page often looks official and may include a countdown timer, adding pressure and making people act before checking whether the prompt is real.
At the last step, the page asks for a recovery phrase or seed phrase as part of the supposed verification process. That is the critical red flag. MetaMask does not ask users to enter seed phrases for this purpose, and once that information is submitted on a fake site, a wallet can be drained within minutes.
Look-alike domains make the trap harder to spot
The scam becomes more dangerous because the websites are designed to closely resemble the original. Attackers buy domains that look almost identical to the real MetaMask address, sometimes changing only one letter or using a slight spelling variation. The layout and formatting can also feel familiar, which lowers suspicion.
That visual similarity is enough to fool many users. The source warns against clicking links received through email or messages and says users should always verify the site address themselves before taking any action related to wallet security.
The method is social engineering, not a direct wallet breach
This case shows a pattern seen across many wallet thefts: the loss does not come from breaking the wallet’s technical defenses. It comes from social engineering. Scammers use fear, pressure, and confusion to push victims into giving up sensitive information voluntarily.
The fake 2FA flow does not defeat MetaMask security in a technical sense. It reframes the theft as a security check and gets the user to complete the handoff. Security researchers repeatedly warn that if a prompt feels rushed or threatening, it is often a sign that something is wrong.
MetaMask has joined efforts to detect phishing sites faster
Wallet providers are also responding. According to the source, MetaMask previously joined a broader network with other major wallets to identify phishing sites more quickly. That move followed a rise in phishing attacks recorded in 2025, which pushed payment wallet providers to strengthen their response to scam operations.
Even so, faster detection on the platform side does not remove the need for user caution. If a seed phrase is entered into a malicious site, attackers may be able to move funds out immediately, and on-chain transfers are often difficult to reverse.
Basic checks can stop the attack before funds are lost
The source lists a few direct precautions. A platform will never ask for a seed phrase. Urgent notices and countdown timers should be treated as warning signs. Users should rely only on official MetaMask apps and verified bookmarks. Pausing before responding to a security prompt may be the simplest defense, especially when the page is trying to force immediate action.