wallet-monitor-snap is a MetaMask Snap that implements a malicious 'showSecurityAlert' method in its onRpcRequest handler. This method opens a dialog inside MetaMask's trusted UI, falsely warning users of unusual activity and requesting their Secret Recovery Phrase (BIP-39 mnemonic). The entered seed phrase is returned to the calling dapp as '{ captured: result }'. The snap declares 'endowment:rpc' with 'dapps: true', allowing any web origin that can reach the snap to invoke this method and receive the seed phrase. In-source comments reveal that advertised RPC methods like 'ping' and 'estimateGas' are decoys to appear legitimate during store review. Compromise of the seed phrase leads to full control over any HD wallet accounts derived from it.

An attacker controlling a dapp that can invoke the snap's RPC methods can trick users into revealing their Secret Recovery Phrase. This results in complete compromise of the user's HD wallet accounts, enabling theft of funds and unauthorized transactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or removal is confirmed, users should avoid installing or using wallet-monitor-snap versions 1.0.2 and 1.0.4. Users who have entered their seed phrase in response to this snap should consider their wallets compromised and take appropriate recovery actions such as transferring assets to a new wallet with a new seed phrase.