Security firm SlowMist warns of a sophisticated social engineering operation that weaponizes “mandatory” security updates to harvest wallet recovery phrases.
Attackers launched a targeted phishing campaign against MetaMask users by utilizing fraudulent Two-Factor Authentication (2FA) alerts. These high-fidelity look-alike domains aim to steal custodial secrets during the opening week of the 2026 market cycle.
Blockchain security firm SlowMist identified the operation Monday. The method relies on mimicking the branding and compliance workflows of the popular wallet provider to deceive victims.
SlowMist’s Chief Information Security Officer, known as 23pds, documented the anatomy of the attack in an urgent public advisory. The firm noted that the scam leverages the growing public demand for enhanced security measures.
Attackers ironically use the premise of “mandatory security upgrades” to lure users into surrendering their most sensitive data.
“New #metamask phishing scam alert,” the official SlowMist account posted on Monday] “Attackers are impersonating a ‘2FA security verification’ flow, redirecting users via look-alike domains to fake security warnings with countdown timers and ‘authenticity checks.’ The final step asks for your wallet recovery phrase, once entered, funds are stolen.”
The Anatomy of the ‘Compliance’ Exploit
The operation employs “typosquatting” by directing users to web domains that differ by a single character from the official MetaMask site. One common variant uses the spelling “mertamask” to bypass the natural skepticism of experienced participants.
Once on the fraudulent portal, users follow a simulated security check featuring countdown timers and authenticity progress bars. The workflow culminates in a prompt requiring the user to enter their seed phrase to finalize the verification.
Security analysts identify the seed phrase request as the critical breach point.
A seed phrase serves as the master key to a self-custodial wallet. It allows attackers to regenerate private keys on a separate device and drain assets without needing passwords or further approvals.
MetaMask currently serves over 100 million annual users. This makes its user base a primary target for such high-fidelity social engineering.
Chain Street’s Take
The sophistication of this campaign lies in its bureaucracy. By dressing up a robbery as a “mandatory compliance update,” attackers are hacking the user’s conditioning to obey security prompts.
The “2FA” label is a brilliant bit of social engineering because it targets people who are actually trying to be responsible. The decline in total phishing volume suggests the “spray and pray” era ended.
It’s been replaced by targeted, high-fidelity traps designed to catch active users during market rallies. The rule remains absolute. No legitimate wallet provider will ever ask for a seed phrase to enable 2FA. If the prompt asks for the keys, it’s a theft.
