According to SlowMist, attackers are impersonating Metamask, aiming to steal users’ secret recovery phrases.