A sophisticated phishing campaign is impersonating two-factor authentication prompts to trick MetaMask users into disclosing their wallet recovery phrases. Security teams warn the fake flow is highly convincing and spreads via cloned sites and deceptive pop-ups.