According to SlowMist, attackers are impersonating Metamask, aiming to steal users’ secret recovery phrases.
You might also be interested in reading State hackers drive 420% surge in onchain malware, Chainalysis finds.
CoinTelegraph