According to SlowMist, attackers are impersonating Metamask, aiming to steal users’ secret recovery phrases.
You might also be interested in reading The “Boring” Apocalypse: Why 2026 Scares the Bitcoin Tourists (And Why We Stay). Happy New Year 2026 Bitcoiners!.