MetaMask users are facing a renewed phishing threat as attackers deploy realistic two-factor authentication flows.