Yeah, it sounds like an attack on the Metamask extension, or the browser hosting it.