Known malicious kitcriticalphishing

Fake "Contact MetaMask Support" help centre that steals the wallet's Secret Recovery Phrase

family: metamask-support-seo-srp-kit-2026-10

Phishing kit posing as MetaMask's support centre, built to be found by people searching for how to contact MetaMask support. The page copies the real support site and is stuffed with search phrases and a fake FAQ. Its "Connect wallet" button opens a box that pretends the connection failed and offers to "Login Manually". That step asks for the 12-word Secret Recovery Phrase, checks every word against the standard wallet word list and marks wrong words in red, so the victim corrects them before submitting. The phrase is sent to a third-party form service, and the victim is then sent on to the real MetaMask support site so nothing looks wrong. MetaMask support never asks for a recovery phrase. The kit has run on contactmetamask[.]top. A match means a page carrying the kit's script, or a scan of one of its known hosts.

Anchors

YARA ruleMetaMask_Support_SEO_SRP_Phish_Kit

SMQL queryrun

contacted_host:contactmetamask.top OR contacted_host:www.contactmetamask.top OR title:"Contact MetaMask Help Center"

Provenance

Added: 2026-10-20 14:55

One hunt for the kit. Rule anchor: the kit's own code (the fields it sends the phrase in, the steps of its fake connection box and its own class names), not MetaMask's brand, so a copy on any domain, with another theme or another form service still matches, and MetaMask's own pages cannot. Search anchor: the kit's known hosts and its page title.

References:

https://x.com/Malwarehunterr/status/2112119388195508517

Sightings (0)Atom feed

No sightings recorded yet.