{"id":537527,"date":"2026-01-05T09:05:12","date_gmt":"2026-01-05T09:05:12","guid":{"rendered":"https:\/\/www.crypto-news-flash.com\/?p=1273561"},"modified":"2026-01-05T09:05:12","modified_gmt":"2026-01-05T09:05:12","slug":"metamask-users-face-new-2fa-phishing-scam-slowmist-says","status":"publish","type":"post","link":"https:\/\/e-bitco.in\/index.php\/2026\/01\/05\/metamask-users-face-new-2fa-phishing-scam-slowmist-says\/","title":{"rendered":"MetaMask Users Face New 2FA Phishing Scam, SlowMist Says"},"content":{"rendered":"<div class=\"eth-editorial-banner\"> <img decoding=\"async\" class=\"eth-editorial-logo\" src=\"https:\/\/www.crypto-news-flash.com\/wp-content\/uploads\/2025\/11\/cnf2-scaled-1-1-1.png\" alt=\"Crypto News Flash\"> <span class=\"eth-editorial-text\">All news is rigorously fact-checked and reviewed by leading blockchain experts and seasoned industry insiders.<\/span> <\/div>\n<ul>\n<li><strong>Attackers spoof MetaMask alerts and fake 2FA pages to steal seed phrases.<\/strong><\/li>\n<li><strong>The Mertamask domain uses typosquatting and urgency tactics to trick users.<\/strong><\/li>\n<\/ul>\n<hr>\n<p>A fresh wave of phishing attempts is circling back toward MetaMask users, this time with a more polished and coordinated setup. SlowMist\u2019s Chief Information Security Officer (CISO) has <a href=\"https:\/\/x.com\/im23pds\/status\/2008008223526400417\" target=\"_blank\" rel=\"noopener\">raised<\/a> the alarm over a new scam framed as a \u201c2FA verification,\u201d built to look far more legitimate than earlier attacks.<\/p>\n<p>This method mimics the official security flow and directs victims to fake websites, one of which is \u201cMertamask.\u201d This is where many users become unprepared, as the interface and narrative appear to originate from MetaMask\u2019s own system.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"zh\" dir=\"ltr\">\ud83d\udea8MetaMask \u51fa\u73b0\u65b0\u578b &#8216;2FA \u5b89\u5168\u9a8c\u8bc1&#8217; \u9a97\u5c40 <a href=\"https:\/\/twitter.com\/MetaMask?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@MetaMask<\/a> <a href=\"https:\/\/twitter.com\/tayvano_?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@tayvano_<\/a> <br \/>\u6ce8\u610f\u9632\u8303 <a href=\"https:\/\/t.co\/RJM78If9zb\">pic.twitter.com\/RJM78If9zb<\/a><\/p>\n<p>\u2014 23pds (\u5c71\u54e5) (@im23pds) <a href=\"https:\/\/twitter.com\/im23pds\/status\/2008008223526400417?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">January 5, 2026<\/a><\/p>\n<\/blockquote>\n<p>The scheme usually starts with a bogus security notice sent by email, warning of suspicious activity in a user\u2019s wallet. The message wastes no time, urging the recipient to \u201cverify\u201d right away. However, instead of going to the official page, users are redirected to a deliberately similar Mertamask domain.<\/p>\n<p>Small changes in the lettering are easy to miss, particularly when an urgent warning pushes someone into panic mode. Once they click through, victims land on a fake 2FA page outfitted with a countdown meant to heighten the pressure.<\/p>\n<figure class=\"wp-caption aligncenter\"><img decoding=\"async\" loading=\"lazy\" class src=\"https:\/\/pbs.twimg.com\/media\/G93g19DaEAAlGnw?format=jpg&amp;name=large\" alt=\"MetaMask fake Website\" width=\"599\" height=\"509\"><figcaption class=\"wp-caption-text\">Image from X<\/figcaption><\/figure>\n<h2><strong>MetaMask Users Tricked Into Handing Over Recovery Phrases<\/strong><\/h2>\n<p>On the fake page, users are asked to follow seemingly logical steps. However, in the final stage, the site asks for a recovery phrase or seed phrase. This is where the scam\u2019s core lies. <a href=\"https:\/\/www.crypto-news-flash.com\/metamask-prepares-new-feature-with-leaked-reward-points-system\/\">MetaMask<\/a> never asks for a seed phrase for verification, updates, or any other security reasons. Once the phrase is entered, control of the wallet is immediately transferred.<\/p>\n<p>Not only that, the asset draining process is usually quick and silent, with victims only realizing it after their balances have been drastically reduced.<\/p>\n<p>Interestingly, this approach marks a shift in the fraudsters\u2019 focus. While previously many attacks relied on random messages or superficial visuals, now the visuals and flow are much more convincing.<\/p>\n<p>Furthermore, psychological pressure has become a primary weapon. Threat narratives, time limits, and a professional appearance combine to make MetaMask users act reflexively, rather than rationally.<\/p>\n<h3><strong>Malicious Contract Signatures Enable Silent Asset Theft<\/strong><\/h3>\n<p>This fake 2FA scheme emerged amid a surge in other phishing attacks also targeting the EVM ecosystem. Recently, hundreds of EVM wallets, primarily MetaMask users, fell victim to fraudulent emails claiming a \u201cmandatory update.\u201d<\/p>\n<p>In these cases, victims were not asked for their seed phrase but instead were lured into signing a malicious contract. Over $107,000 was stolen in small amounts from each wallet, a strategy that makes the theft difficult to detect individually. This pattern exploits the speed of transaction signatures, as opposed to direct seed phrase theft.<\/p>\n<p>On the other hand, on December 9, we <a href=\"https:\/\/www.crypto-news-flash.com\/metamask-cross-chain-rango-integration\/\">reported<\/a> that MetaMask had expanded cross-chain exchanges through its Rango multi-chain routing infrastructure. What started with the EVM and Solana has now expanded to <a href=\"https:\/\/www.crypto-news-flash.com\/what-is-bitcoin-btc-history-and-beginner-guide\/\">Bitcoin<\/a>, giving users even broader cross-chain reach.<\/p>\n<p>A few days earlier, on December 5, we also <a href=\"https:\/\/www.crypto-news-flash.com\/metamask-polymarket-integration-mobile\/\">highlighted<\/a> the direct integration of Polymarket into MetaMask Mobile, allowing users to participate in prediction markets without leaving the app and earn MetaMask Rewards.<\/p>\n<p>Also, in late November, we <a href=\"https:\/\/www.crypto-news-flash.com\/metamask-just-opened-the-door-to-global-stock-perps-trading\/\">covered<\/a> the on-chain equity perpetual trading feature in MetaMask Mobile, which opens access to long and short positions on a variety of global assets with leverage options.<\/p>\n<p> <a href=\"https:\/\/www.crypto-news-flash.com\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>All news is rigorously fact-checked and reviewed by leading blockchain experts and seasoned industry insiders. Attackers spoof MetaMask alerts and fake 2FA pages to steal seed phrases. The Mertamask domain uses typosquatting and urgency tactics to trick users. A fresh wave of phishing attempts is circling back toward MetaMask users, this time with a more [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":537528,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[464,1717,25,760],"class_list":{"0":"post-537527","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-other","8":"tag-crypto-wallet","9":"tag-metamask","10":"tag-news","11":"tag-phishing"},"_links":{"self":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts\/537527","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/comments?post=537527"}],"version-history":[{"count":0,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts\/537527\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/media\/537528"}],"wp:attachment":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/media?parent=537527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/categories?post=537527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/tags?post=537527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}