intro-chromextension[.]wixstudio[.]com

This domain, intro-chromextension.wixstudio.com, poses a targeted brand impersonation threat against MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site was designed to deceive users into believing they are interacting with an official MetaMask extension download page, as evidenced by the page title 'MetaMask Wallet® | Extension™.' The objective is likely to distribute malicious browser extensions or harvest sensitive credentials, enabling attackers to gain unauthorized access to victims' crypto wallets and drain funds. The use of official branding elements, including logos and trademark symbols, increases the likelihood of successful social engineering, particularly among users seeking legitimate wallet software. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on April 12, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 17 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and holds a Gridinsoft trust score of 0 out of 100. The SSL certificate is issued by Let's Encrypt, a common tactic among threat actors to lend a false sense of legitimacy to phishing sites. Detected technologies include Wix, React, Lodash, and Google Cloud CDN, suggesting a professionally constructed front-end designed to evade initial suspicion. Users who visited intro-chromextension.wixstudio.com should take immediate action to mitigate potential compromise. First, revoke any browser extensions installed from this domain and run a full system scan using updated security software to detect malware. If wallet credentials or seed phrases were entered, transfer remaining assets to a new, secure wallet and monitor transaction history for unauthorized activity. Reset passwords for any accounts accessed during or after the visit, and enable multi-factor authentication where available. Given the elevated risk of crypto wallet compromise, affected users should also report the incident to relevant blockchain security teams and consider notifying their exchange platforms to flag suspicious withdrawal attempts.