Hook
Over the past 72 hours, SlowMist published a sample analysis of a malware campaign so surgical it could only be aimed at one demographic: Web3 developers, auditors, and founders. The lure is a fake AI meeting tool called 'Relay'—posed as a recruitment screening software. The payload? A cross-platform infostealer that exfiltrates browser credentials, cryptocurrency wallet data, macOS keychain secrets, and Telegram session tokens. The attack chain is complete, the samples are confirmed, and the infection vector is social engineering at its most predatory. But the real story isn't the malware itself—it's that the attack works because Web3 professionals have been trained to trust 'innovation first, audit later.' That trust just became a liability.
Context
The campaign surfaced in late July 2025. Attackers impersonate headhunters from legitimate Web3 firms—often via LinkedIn or Telegram—and invite targets to a video interview using 'Relay,' an AI-powered meeting tool that allegedly improves remote interview quality. The targets are not random; they are individuals with public profiles showing crypto wallet addresses, GitHub repos with smart contract code, or listed as part of a DAO core team. The goal is not mass infection but precision intrusion. Once the victim downloads and runs the installer (available for both macOS and Windows), the malware executes a silent extraction of sensitive data, including private keys, browser cookies, and Telegram auth files. The attack is immediate but the financial impact is delayed—often days or weeks later, when wallets start bleeding.
This is not a zero-day. It is a carefully crafted application of existing attack techniques—cross-platform infostealer design, credential harvesting, session hijacking—married to a narrative that exploits the Web3 community's obsession with AI tools and decentralized hiring. The vector is not code; it's context. And that makes it harder to defend against.
Core: Code-Level Analysis and Trade-Offs
Based on the sample analysis published by SlowMist—and drawing from my own experience auditing smart contracts and reviewing malicious contract deployment patterns—the attack can be broken down into three execution stages.
Stage 1: The Trojanized Installer
The 'Relay' installer (SHA256 hash available in SlowMist's IOC list) is a legitimate-looking Electron application bundled with a compiled payload. On macOS, the payload abuses a common technique: it requests accessibility permissions via a fake dialog, then drops a second-stage binary into ~/Library/LaunchAgents/ for persistence. On Windows, it uses a similar approach but with a DLL sideloading vulnerability against a legitimate Microsoft-signed binary. The code is not obfuscated at a high level—I suspect the attackers are not trying to hide from automated analysis but from human scrutiny. They rely on the user to click 'Allow' without reading. The trade-off here is between stealth and execution speed: a heavily obfuscated payload would trigger more antivirus flags, so they chose a lighter touch.
Stage 2: Data Harvesting
The malware scans for local installations of MetaMask, Phantom, Ledger Live, and Trezor Suite. It does not break encryption—it simply reads the plaintext databases or configuration files. For browser wallets, it extracts cookies and saved passwords from Chromium-based browsers (Chrome, Brave, Edge) and Gecko-based (Firefox). For Telegram, it steals the local session file (tdata), allowing remote logins. For macOS, it dumps the keychain via a spawned security command. The harvest is then base64-encoded and exfiltrated over HTTPS to a command-and-control server registered using a privacy domain. This is not a sophisticated exploit; it is a systematic abuse of the fact that most Web3 professionals store their seeds or private keys in plaintext on their daily driver machines.
Stage 3: Delayed Withdrawal
The malware does not immediately drain wallets—that would alert the victim. Instead, it sends the credentials to the attacker, who then waits for a quiet moment (typically a weekend or holiday) to execute transfers. Based on blockchain forensics from similar previous attacks, the funds are routed through a series of mixers and cross-chain bridges to avoid tracing. The logic is binary: the wallet is compromised the moment you click 'install'; the loss is just a matter of time.
Logic is binary; intent is often ambiguous. The attackers’ intent, however, is crystal clear: steal private keys. The ambiguity lies only in how many victims will ignore the warning signs.
Contrarian: The Blind Spot Nobody Talks About
The common narrative will focus on 'raise security awareness,' 'use hardware wallets,' and 'verify recruiters.' All true, but all surface-level. The real blind spot is not individual user behavior—it's the incentive structure of Web3 hiring itself.
Think about it: a Web3 native who posts their address on a public GitHub, participates in a DAO, and lists their ENS name on a resume is essentially broadcasting 'I have assets here.' The job market creates a honeypot. Traditional finance executives don't publish their portfolio balances; crypto natives do—as proof of skill or status. This campaign exploits that transparency.
Moreover, the attack leverages a trust assumption in the 'AI interview' trend. We've spent three years telling ourselves that decentralized tools are inherently more secure than centralized ones because they eliminate intermediaries. But an AI meeting tool is just an intermediary in disguise—a new party that requires its own trust assumptions. The code is 'open source'? The attacker's code is also open source—just not audited. The same community that demanded smart contract audits before depositing capital is now downloading unvetted binaries because the word 'AI' appears in the description. The paradox: Web3 developers, who would never deploy a contract without a third-party audit, will install a binary without even checking its hash.
This is a failure of operational security at the protocol level of human behavior. The mitigation is not more antivirus tools—it's a fundamental shift in how we verify identity in remote hiring. Zero-trust architecture for recruitment: dont run code on your host machine. Use a dedicated virtual machine or a disposable cloud instance. And yes, hardware wallets should never be plugged into a machine that runs unverified software. But the root cause is not the malware—it is the absence of a standard for secure Web3 interviews.
Takeaway: Vulnerability Forecast
This is not a one-off. Expect a wave of imitators within weeks. The toolkit is already available on darknet forums, and the social engineering template is trivial to replicate. The real question is not 'will this spread?' but 'how long before the industry builds a defense?'
My forecast: within six months, we will see dedicated 'safe interview' protocols—maybe even on-chain KYC for recruiters, combined with browser-based sandboxed environments that cannot access the local file system. Until then, every Web3 professional should treat every unsolicited interview invitation as a potential zero-day. The safest wallet is the one that never meets an untrusted application.