VORANT. Threat Intelligence Sign in Get the full feed

Metamask phishing targets secret recovery phrases

medium vulnerability financial-services

A phishing campaign against Metamask cryptocurrency wallet users bypasses 2FA by requesting secret recovery phrases instead of credentials.

A new phishing campaign targeting Metamask cryptocurrency wallet users has been observed using a social engineering technique that bypasses two-factor authentication by requesting victims' secret recovery phrases rather than traditional credentials. The attack leverages the legitimate password recovery process used by Metamask, which relies on a secret security phrase created during account setup.

The phishing emails create urgency by claiming the victim's wallet is at risk, then direct users to provide their secret recovery phrase through a fraudulent site. The campaign uses the domain captchasolve[.]help, which was registered just two days prior to the observed activity. This approach is notable because it sidesteps the need to intercept time-based authentication codes or interact with victims during login, instead exploiting the backup recovery mechanism that provides full account access.

Metamask has been a consistent target for phishing campaigns due to its popularity as a cryptocurrency wallet. This campaign represents an evolution in tactics, focusing on the recovery mechanism rather than attempting to defeat multi-factor authentication through real-time interaction or credential theft.

Detection guidance

Web Request Containing MetaMask Secret Recovery Phrase Prompt on Non-Official Domain

ATT&CK T1566.002

Detects outbound web requests to non-MetaMask domains where the URI or form parameters reference a wallet secret recovery/seed phrase, consistent with phishing pages harvesting wallet backup phrases. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Web Request Referencing Wallet Recovery Phrase
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - secretRecoveryPhrase
    - secret-recovery-phrase
    - seedphrase
    - seed-phrase
    - recovery-phrase
  filter_legit:
    r-dns|contains:
    - metamask.io
    - consensys.io
  condition: selection and not filter_legit
falsepositives:
- Legitimate MetaMask support or documentation pages referencing recovery phrase terminology
- Security awareness training platforms simulating phishing pages
level: high
tags:
- attack.T1566.002
- attack.T1598.003
id: e7a62563-2d61-5c15-8c15-cfa6f07c54dc
status: experimental
author: Vorant

DNS Query to Newly Registered Domain Mimicking MetaMask Branding

ATT&CK T1598.003

Detects DNS resolution of domains containing MetaMask-related or wallet-security-recovery themed strings that are not part of known legitimate MetaMask infrastructure, indicative of phishing domain impersonation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: DNS Query to Domain Impersonating MetaMask Branding
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    query|contains:
    - metamask-support
    - metamask-wallet
    - metamask-recovery
    - metamasksecure
    - captchasolve
  filter_legit:
    query|endswith:
    - .metamask.io
  condition: selection and not filter_legit
falsepositives:
- Security research or brand-monitoring tools querying typosquat domains for defensive
  purposes
level: medium
tags:
- attack.T1598.003
- attack.T1566.002
id: b5aff49e-5436-5ca5-8933-9bc3d7c03b98
status: experimental
author: Vorant

Outbound Email Link Click to Wallet Recovery Phishing Page via Impersonated Sender

ATT&CK T1656

Detects proxy logs showing a user navigating from a webmail referrer directly to a non-MetaMask domain presenting wallet security/verification urgency themes, consistent with phishing link impersonation of MetaMask support. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Referral From Webmail to Suspicious Wallet Verification Domain
logsource:
  category: proxy
  product: windows
detection:
  selection:
    cs-referrer|contains:
    - mail.google.com
    - outlook.office.com
    - outlook.live.com
    c-uri|contains:
    - verify
    - unlock
    - wallet-security
    - account-recovery
  filter_legit:
    r-dns|endswith:
    - metamask.io
    - google.com
    - microsoft.com
  condition: selection and not filter_legit
falsepositives:
- Users clicking legitimate account security or password reset emails from other verified
  services
- Corporate SSO or MFA re-enrollment workflows that use similar URL keywords
level: low
tags:
- attack.T1656
- attack.T1566.002
id: fdbc4df8-d894-520b-9261-0dff14e2ef90
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33118

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free