Urgent Warning: Sophisticated 2FA Scam Targets MetaMask Wallets

A new phishing scam is targeting MetaMask users, utilizing fake two-factor authentication (2FA) pages designed to steal wallet recovery phrases. These sophisticated attacks mimic MetaMask’s security interface, tricking users into providing sensitive information. Although overall phishing losses have decreased in 2025, threat actors are refining their tactics, leading to the emergence of new attack vectors.

Key Takeaways

Phishing Scam: A new 2FA scam is targeting MetaMask users with fake verification pages.
Deceptive Practices: Attackers use spoofed domain names and convincing interfaces to steal seed phrases.
Phishing Decline: While phishing losses overall have dropped, attackers are adapting their strategies.
Industry Response: Major wallet providers are collaborating through a global defense network to combat phishing threats.
Emerging Threats: Deepfake technology and social engineering tactics pose new risks in the crypto space.

SlowMist Warns of Sophisticated 2FA Scam Targeting MetaMask Wallets

Main Content

SlowMist's Chief Security Officer, known as “23pds,” has issued an urgent alert about a sophisticated phishing scam aimed at MetaMask users. This scam employs fake two-factor authentication verification pages specifically designed to steal wallet recovery phrases.

The attack mimics the security interface of MetaMask, using fake domain names that closely resemble the legitimate site. This technique tricks users into thinking they are engaging in standard security procedures, ultimately leading to the theft of crucial wallet credentials.

How the Scam Works

The scam unfolds in multiple deceptive phases that capitalize on user trust regarding security protocols. Attackers create fraudulent domains such as “mertamask” rather than “metamask” and redirect victims to convincing security alert pages that seem authentic.

Victims are presented with what looks like a standard 2FA verification screen, complete with countdown timers and realistic safety reminders. This setup builds false confidence before users are prompted to divulge their seed phrase under the pretense of completing the authentication process.

Evolution of Phishing Tactics

Despite an overall sharp decline in phishing losses in 2025—from nearly $494 million in the previous year to $83.85 million, representing an 83% drop—the methods employed by attackers are continuing to evolve.

As reported by Cryptonews, the number of affected users decreased to around 106,000, a reduction of 68% year-over-year. However, elaborate schemes like the MetaMask 2FA scam indicate that threat actors are still refining their social engineering tactics.

Phishing activity in 2025 mirrored broader market dynamics, with the highest losses recorded in the third quarter at $31 million during Ethereum's peak rally. August and September accounted for almost 29% of the total annual losses, highlighting a correlation between transaction volumes and the potential victim pool.

Notably, a significant incident in September involved a theft of $6.5 million related to a malicious Permit signature. Permit and Permit2 approvals remained the most effective attack vectors, causing 38% of losses in incidents exceeding $1 million.

Industry Response to Ongoing Threats

In response to these persistent threats, major wallet providers—including MetaMask, Phantom, WalletConnect, and Backpack—have teamed up to establish a global phishing defense network with the Security Alliance (SEAL). They aim to create a “decentralized immune system” for the real-time identification of threats.

This system enables individuals to submit verifiable phishing reports that are promptly validated and shared among participating wallets, speeding up response times and potentially safeguarding more funds.

“Drainers are a constant cat-and-mouse game,” explained MetaMask security researcher Ohm Shah. “Collaborating with SEAL allows wallet developers to react quickly and disrupt the drainers’ operations.“

Moreover, the defense initiative builds on SEAL's verifiable phishing reports tool, which allows security researchers to confirm whether reported websites indeed contain phishing content.

In addition to these technical risks, deepfake technology has emerged as a fresh threat vector. Manta Network co-founder Kenny Li disclosed an instance in April where he was targeted in a sophisticated Zoom call involving pre-recorded videos of recognizable individuals. The attackers tried to trick him into downloading malignant script files disguised as Zoom updates, which he suspects may be tied to the North Korea-connected Lazarus Group.

Despite a notable 60% decrease in crypto-related losses from hacks and security exploits in December, dropping to about $76 million from $194.2 million in November, security analysts warn that issues like address-poisoning scams and browser wallet exploits remain prevalent across the ecosystem.