Metamask phishing targets secret recovery phrases
A phishing campaign against Metamask cryptocurrency wallet users bypasses 2FA by requesting secret recovery phrases instead of credentials.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
A new phishing campaign targeting Metamask cryptocurrency wallet users has been observed using a social engineering technique that bypasses two-factor authentication by requesting victims' secret recovery phrases rather than traditional credentials. The attack leverages the legitimate password recovery process used by Metamask, which relies on a secret security phrase created during account setup.
The phishing emails create urgency by claiming the victim's wallet is at risk, then direct users to provide their secret recovery phrase through a fraudulent site. The campaign uses the domain captchasolve[.]help, which was registered just two days prior to the observed activity. This approach is notable because it sidesteps the need to intercept time-based authentication codes or interact with victims during login, instead exploiting the backup recovery mechanism that provides full account access.
Metamask has been a consistent target for phishing campaigns due to its popularity as a cryptocurrency wallet. This campaign represents an evolution in tactics, focusing on the recovery mechanism rather than attempting to defeat multi-factor authentication through real-time interaction or credential theft.
Detection guidance
Web Request Containing MetaMask Secret Recovery Phrase Prompt on Non-Official Domain
A behavioural hunt for the technique in general.
Detects outbound web requests to non-MetaMask domains where the URI or form parameters reference a wallet secret recovery/seed phrase, consistent with phishing pages harvesting wallet backup phrases. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Web Request Referencing Wallet Recovery Phrase
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- secretRecoveryPhrase
- secret-recovery-phrase
- seedphrase
- seed-phrase
- recovery-phrase
filter_legit:
r-dns|contains:
- metamask.io
- consensys.io
condition: selection and not filter_legit
falsepositives:
- Legitimate MetaMask support or documentation pages referencing recovery phrase terminology
- Security awareness training platforms simulating phishing pages
level: high
tags:
- attack.t1566.002
- attack.t1598.003
id: e7a62563-2d61-5c15-8c15-cfa6f07c54dc
status: experimental
author: Vorant
Outbound Email Link Click to Wallet Recovery Phishing Page via Impersonated Sender
A behavioural hunt for the technique in general.
Detects proxy logs showing a user navigating from a webmail referrer directly to a non-MetaMask domain presenting wallet security/verification urgency themes, consistent with phishing link impersonation of MetaMask support. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Referral From Webmail to Suspicious Wallet Verification Domain
logsource:
category: proxy
detection:
selection:
cs-referrer|contains:
- mail.google.com
- outlook.office.com
- outlook.live.com
c-uri|contains:
- verify
- unlock
- wallet-security
- account-recovery
filter_legit:
r-dns|endswith:
- metamask.io
- google.com
- microsoft.com
condition: selection and not filter_legit
falsepositives:
- Users clicking legitimate account security or password reset emails from other verified
services
- Corporate SSO or MFA re-enrollment workflows that use similar URL keywords
level: low
tags:
- attack.t1684.001
- attack.t1566.002
id: fdbc4df8-d894-520b-9261-0dff14e2ef90
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33118
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs