MetaMask users face a new phishing scam using fake 2FA and security alerts to steal seed phrases and drain wallets.