According to SlowMist, attackers are impersonating MetaMask, aiming to steal users’ secret recovery phrases.