What happened

A phishing email impersonating MetaMask (party-hat fox logo) tells users a *mandatory 2026 system upgrade* is required to keep their account active. The link leads to a drainer site that empties EVM wallets across multiple chains, typically for under $2,000 per victim.

On-chain analyst ZachXBT flagged hundreds of victims; cumulative theft exceeds $107,000 as of disclosure.