IOK Rules: target.metamask

Metamask Phishing Kit 604ec65

Metamask Phishing kit that uses WebFlow. Allowing us to flag it due to it having the same WebFlow site key for each phish.

Metamask Phishing Kit 06f6d4f9

Metamask Phishing kit that uses tries to socially engineer the victim into supplying their secret recovery phrases or private key. This kit is made by an Arabic/Hindi speaking threat actor, as seen by the various words like 'tsawer' and 'gadha' being used in the HTML & JS.