The metaverse is envisioned as a digital world where people can experience an immersive three-dimensional Internet, thanks to the profound integration of different technologies like the Internet of Things (IoT), augmented and virtual reality. From a technical point of view, developing a system of such an unprecedented scale and complexity also opens new challenges in security: a prominent one is the capability to detect and respond to cyberattacks in the shortest time possible, so as not to disrupt the live user experience. In this paper, we discuss how recent advances in user-plane inference can be leveraged to identify malicious traffic generated by IoT devices connected to the metaverse at line rate, ensuring a faster reaction than stateof- the-art approaches where the attack detection is performed in the control plane. We demonstrate the viability of the solution in a programmable network testbed composed of off-the-shelf Intel Tofino switches and with real-world traffic hiding a number of different IoT-based cyberattacks. Our experimental results show that Random Forest models implemented in programmable switches can achieve up to 99% accuracy while using less than 5% of the hardware resources on average in the target case study. Moreover, they quantify the existing trade-off between attack detection precision and user plane resource consumption.