← Fake MetaMask Update Phishing Campaign (May 2026)reviewed 2026-09-07 · 26 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Fake MetaMask Update Phishing Campaign (May 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 3unverifiable 1link rot 1partially supported 4confirmed 174 corrections pending · 0 applied
disputed
3 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #15[disputed][awaiting moderator]in section: Parallel and Related Incidents
“Researchers at the SANS Internet Storm Center reported a campaign beginning around March 9, 2026 in which phishing emails containing a PDF attachment titled 'Security_Reports.pdf' warned of suspicious login activity.”
reviewerThe SANS Internet Storm Center reported the fake-security-report MetaMask phishing campaign beginning around March 9, 2026.The page appears to have used the date a secondary write-up (Paubox) was published rather than the actual SANS ISC diary/discovery date, which was February 17, 2026, corroborated independently by CyberSecurityNews' February 18, 2026 article -- one of the page's own cited sources for this section.Proposed correction (not yet applied)Researchers at the SANS Internet Storm Center reported a campaign beginning around February 17, 2026 in which phishing emails containing a PDF attachment titled 'Security_Reports.pdf' warned of suspicious login activity. - #16[disputed][awaiting moderator]in the timeline
“2026-03-09”
reviewerTimeline: SANS Internet Storm Center campaign identified around 2026-03-09.Same underlying date error as the corresponding section 3 prose; the timeline date field should read 2026-02-17, the SANS ISC diary publish date, not the later Paubox write-up date of March 9, 2026.Proposed correction (not yet applied)2026-02-17 - #21[disputed][awaiting moderator]in the timeline
“2025-10-15”
reviewerTimeline: SEAL/MetaMask/Phantom/WalletConnect/Backpack phishing defense network launch dated 2025-10-15.Multiple independent outlets place the SEAL announcement around October 21-23, 2025, roughly a week later than the timeline's stated October 15, 2025.Proposed correction (not yet applied)2025-10-21
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #12[unverifiable][awaiting moderator]in section: Infrastructure and Attribution
“No law enforcement arrests or regulatory actions specifically related to this campaign have been publicly announced as of June 2026.”
reviewerNo law enforcement arrests or regulatory actions specifically related to this campaign have been publicly announced as of June 2026.A negative/absence claim; no contradicting reports were found, but this cannot be affirmatively confirmed via search.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #26[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260726083311/https://coinjournal.net/news/cardano-price-jumps-to-0-38-as-bulls-reclaim-key-level/?dynamic”
reviewerThe archived snapshot for the CoinJournal source correctly preserves the cited MetaMask 2FA phishing article.The archive_url attached to this source record points to a completely different, unrelated CoinJournal article. A Wayback Machine availability check found no archived snapshot exists for the correct URL, so no live replacement archive link could be located; the live source URL itself remains reachable.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in section: Campaign Overview
“By May 30, 2026, ZachXBT's running tally placed total losses above $9 million spread across more than 400 distinct victim addresses.”
reviewerCryptoSlate is cited as a supporting source for the May 30, 2026 $9 million/400+ address figure.The CryptoSlate URL is a legitimate source for the January 3, 2026 timeline entry but is miscited here as support for the May 30 $9M figure, which it does not discuss. - #7[partially supported][awaiting moderator]in section: Attack Mechanics
“Fourth, once connected, the site presented what appeared to be a routine upgrade confirmation but was in fact a Permit2 universal token-approval transaction granting the drainer contract unlimited ERC-20 allowances.”
reviewerThe clone site presented a Permit2 universal token-approval transaction granting the drainer contract unlimited ERC-20 allowances.The underlying technical mechanism (Permit2-style approval drains) is independently well documented and plausible, but the page cites quarklab.cc as a 'research' source with credibility 2; in fact this domain is the self-published marketing/technical documentation for a criminal drainer-as-a-service product, not neutral research. The source type/credibility rating is a mischaracterization. - #19[partially supported][awaiting moderator]in section: Scale and Financial Impact
“For broader context, Scam Sniffer data cited in coverage of the January 2026 2FA campaign showed that total crypto phishing losses across all vectors fell approximately 83% year-over-year in 2025 to $83.3 million.”
reviewerScam Sniffer data showed total crypto phishing losses fell approximately 83% year-over-year in 2025 to $83.3 million.The 83% year-over-year decline is directionally correct and independently verifiable via Scam Sniffer's actual report, but (a) the dollar figure is off by roughly half a million dollars from the commonly reported $83.85M, and (b) the page's own cited source (CoinJournal) does not actually contain this statistic. - #25[partially supported][awaiting moderator]in section: Infrastructure and Attribution
“The phishing infrastructure demonstrated a level of operational maturity that security researchers attributed to an established drainer-as-a-service team rather than opportunistic actors.”
reviewerQuark Lab's technical analysis is cited as a research source informing the drainer-as-a-service attribution narrative.This finding groups with the section 1 (Attack Mechanics) quarklab.cc citation -- both instances mischaracterize a drainer-vendor's own marketing site as neutral 'research.' The broader attribution claim (drainer-as-a-service team) is independently plausible via ZachXBT/Phemex reporting, but this specific citation undermines its own credibility label.
confirmed
17 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Campaign Overview
“In the final week of May 2026 a coordinated phishing campaign began delivering emails and push notifications impersonating MetaMask, the widely used self-custodial EVM wallet operated by Consensys.”
reviewerA coordinated phishing campaign impersonating MetaMask with a 'mandatory 2026 system upgrade' lure began in the final week of May 2026, using clone sites to solicit a token-approval signature.Independently corroborated by the Phemex writeup and consistent with contemporaneous secondary coverage of the campaign. - #2[confirmed][no action needed]in section: Campaign Overview
“On-chain investigator ZachXBT flagged the pattern on approximately May 28, 2026 after tracing a cluster of related drain transactions across Ethereum, Polygon, Arbitrum, and Base.”
reviewerOn-chain investigator ZachXBT flagged the drain-transaction pattern on approximately May 28, 2026.Date and chain list match the Phemex source directly. - #3[confirmed][no action needed]in section: Campaign Overview
“By May 30, 2026, ZachXBT's running tally placed total losses above $9 million spread across more than 400 distinct victim addresses.”
reviewerBy May 30, 2026, ZachXBT's running tally placed total losses above $9 million across more than 400 distinct victim addresses.The $9M/400+ address figure itself is confirmed via Phemex, but the section cites CryptoSlate as a joint source for the whole paragraph even though the CryptoSlate article is about a different, earlier, much smaller campaign. See separate citation finding. - #5[confirmed][no action needed]in section: Campaign Overview
“Average per-wallet losses sat in the low five-figure range, indicating the campaign targeted users with meaningful holdings rather than sweeping indiscriminately for small balances.”
reviewerAverage per-wallet losses in the May 2026 campaign sat in the low five-figure range.Consistent with the cited source. - #6[confirmed][no action needed]in section: Campaign Overview
“MetaMask is an impersonated victim in this incident and bears no operational responsibility for the losses.”
reviewerMetaMask is an impersonated victim in this incident and bears no operational responsibility for the losses.Standard, well-supported characterization for a brand-impersonation phishing campaign. - #8[confirmed][no action needed]in section: Attack Mechanics
“Second, clicking the embedded link directed victims to a typo-squatted domain (reported examples include metamasks-update.com, metamask-validator.io, and secure-metamask.app) hosting a pixel-accurate clone of MetaMask's interface.”
reviewerReported phishing domain examples for the campaign include metamasks-update.com, metamask-validator.io, and secure-metamask.app.Domain list matches the Phemex source verbatim. - #9[confirmed][no action needed]in section: Infrastructure and Attribution
“ZachXBT identified a single hot wallet that had dripped gas funding to the drainer contracts on all four chains, suggesting a single operator or tightly coordinated team controlled the on-chain infrastructure.”
reviewerZachXBT identified a single hot wallet that dripped gas funding to the drainer contracts on all four chains.Matches the cited source. - #10[confirmed][no action needed]in section: Infrastructure and Attribution
“The campaign was funded from a non-KYC offshore exchange, and proceeds were laundered via Tornado Cash alternatives with rapid cross-chain bridging.”
reviewerThe campaign was funded from a non-KYC offshore exchange, with proceeds laundered via Tornado Cash alternatives and rapid cross-chain bridging.Consistent with Phemex reporting; page appropriately frames this as ZachXBT's finding rather than an independently confirmed fact. - #11[confirmed][no action needed]in section: Infrastructure and Attribution
“with affiliates paying approximately 20–30% of gross proceeds for access to the drainer contracts, domain rotation, and laundering pipeline”
reviewerAffiliates in the drainer-as-a-service model pay approximately 20-30% of gross proceeds for access to the drainer infrastructure.Correctly attributed to ZachXBT's hypothesis as reported by Phemex, appropriately hedged elsewhere on the page. - #13[confirmed][no action needed]in section: Parallel and Related Incidents
“SlowMist chief security officer '23pds' flagged a campaign beginning around January 5, 2026 in which fraudulent emails impersonating MetaMask Support demanded that users activate 'mandatory two-factor authentication' before a stated deadline.”
reviewerSlowMist chief security officer '23pds' flagged a fake-2FA MetaMask phishing campaign beginning around January 5, 2026, ultimately requesting the 12-word seed phrase.Corroborated by multiple independent Tier 2 outlets (Yahoo/CryptoNews, TheCryptoBasic, CoinJournal) all dated January 5, 2026. - #14[confirmed][no action needed]in section: Parallel and Related Incidents
“No aggregate loss figure was disclosed by SlowMist for this specific campaign.”
reviewerNo aggregate loss figure was disclosed by SlowMist for the January 2026 fake-2FA campaign.Consistent with the absence of a loss figure across all reviewed coverage of this specific campaign. - #17[confirmed][no action needed]in section: Parallel and Related Incidents
“The attachment, created using the legitimate Python library ReportLab, contained no malware but served as social proof to motivate victims to click an embedded link redirecting to a counterfeit MetaMask login page hosted on an Amazon Web Services S3 storage bucket (hxxps://access-authority-2fa7abff0e.s3.us-east-1.amazonaws.com/index.html).”
reviewerThe Security_Reports.pdf attachment was created using the ReportLab Python library and linked to a counterfeit MetaMask login page hosted on an AWS S3 bucket.Technical details (ReportLab, S3 hosting, non-malicious PDF) are independently confirmed, even though the section's date attribution is wrong (see sans-isc-metamask-date finding). - #18[confirmed][no action needed]in section: Parallel and Related Incidents
“A real estate broker in Vijayawada, Andhra Pradesh, India lost approximately INR 1.4 crore (approximately $168,000 USD) to a separate MetaMask-related social engineering scheme in which fraudsters posed as cryptocurrency investment experts on social media, onboarded the victim into a legitimate MetaMask wallet, deposited fake tokens to simulate profits, and then extracted two real-money transfers via corporate mule bank accounts.”
reviewerA real estate broker in Vijayawada, India lost approximately INR 1.4 crore (~$168,000) to a MetaMask-related social engineering scheme involving fake investment experts and mule accounts, with one phone number traced to the UK and a female accomplice fleeing the country.Details match independent reporting closely. - #20[confirmed][no action needed]in section: Industry Defense Response
“In October 2025, ahead of the 2026 campaign wave, MetaMask, Phantom, WalletConnect, and Backpack joined the Security Alliance (SEAL) to launch a real-time global phishing defense network.”
reviewerIn October 2025, MetaMask, Phantom, WalletConnect, and Backpack joined the Security Alliance (SEAL) to launch a real-time global phishing defense network.The month-level claim in the section prose is accurate; the specific day given in the timeline entry is not (see seal-launch-date finding). - #22[confirmed][no action needed]in section: Industry Defense Response
“The SEAL initiative was specifically designed to counter drainer campaigns including Inferno Drainer and Angel Drainer.”
reviewerThe SEAL initiative was specifically designed to counter drainer campaigns including Inferno Drainer and Angel Drainer.Matches independent reporting. - #23[confirmed][no action needed]in section: Industry Defense Response
“MetaMask itself has consistently stated publicly that it never sends unsolicited emails, never requests 2FA activation via email, never asks for seed recovery phrases under any circumstances, and does not initiate email correspondence unless a user has opened a support ticket.”
reviewerMetaMask has consistently stated it never sends unsolicited emails, never requests 2FA activation via email, never asks for seed recovery phrases, and only initiates email correspondence when a user has opened a support ticket.Standard, well-established official guidance from MetaMask's own support documentation. - #24[confirmed][no action needed]in section: Industry Defense Response
“MetaMask's own eth-phishing-detect GitHub repository (github.com/MetaMask/eth-phishing-detect) maintains a community-updated blocklist of phishing domains.”
reviewerMetaMask's eth-phishing-detect GitHub repository maintains a community-updated blocklist of phishing domains.Trivially verifiable, well-known public repository.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.