We didn't see this coming. Not the smart contract exploits, not the rug pulls, not the bridge hacks. Those are old news. This is new. A threat vector so insidious it bypasses every audit, every multisig, every hardened validator set—and goes straight for the human, the core of Web3's talent pool.
On July 29, 2025, SlowMist dropped a chilling report. Attackers posing as recruiters for top Web3 companies are sending candidates a fake AI meeting tool called 'Relay.' It's not harmless interview software. It's a cross-platform infostealer—built specifically to drain crypto wallets, steal browser credentials, hijack Telegram sessions, and own your machine. This is not a spray-and-pray scam. This is a precision strike against the very people who build and maintain this industry.
Deep dive: Let's cut through the FUD and look at the code. Because what everyone is missing is that this attack doesn't just steal your lunch money—it steals your identity.
Context: The Perfect Storm
Web3 hiring is broken in a way that makes this attack inevitable. Remote work is the norm. LinkedIn is flooded with recruiter DMs. Telegram groups are the new job boards. And AI meeting tools like Otter.ai, Fireflies, or custom 'evaluation platforms' are now standard in many interview processes. The attacker simply apes this reality.
They create fake recruiter profiles—often with real names and photos stolen from actual employees. They reach out to candidates with a promising pitch: 'We'd like you to test our new AI meeting assistant as part of the interview.' The victim clicks, downloads the app (macOS or Windows), and runs it. That's the moment the malware sinks its teeth.
But why this specific attack, and why now? Because the market is flooded with talent after the 2022-2023 bear, and desperation meets opportunity. I've seen this pattern before: back in 2017, ICO scams used whitepapers. Now they use fake AI interview tools. The tools change; the psychology remains the same. Trust is the exploit vector.
Core: The Malware Autopsy
Now, let's get technical. Based on SlowMist's sample analysis—and I've confirmed similar patterns with our own threat intel at the exchange—here's what the malware does, step by step.
First, the delivery. The 'Relay' app is a signed binary (at least for macOS). It uses standard code-signing certificates, likely stolen or issued through a shell company. This bypasses Gatekeeper on macOS and Windows Defender on first-run scans. The app's UI is functional enough to pass a quick glance: a clean landing page with a 'Join Meeting' button. Clicking that triggers the real payload.
The payload is modular. It contains three primary stealers:
- Browser Credential Stealer: Targets Chrome, Firefox, Brave, and Edge. Extracts saved passwords, cookies, and autofill data. But the real prize is the extensions. The malware specifically looks for wallet extensions: MetaMask, Phantom, Rabby, Rainbow, Keplr, and more. It reads the extension storage—which often contains encrypted seed phrases if the user hasn't set a strong password. Even if encrypted, the malware can hook the browser to intercept decryption when the user unlocks the wallet.
- System Keychain/Keyring Extractor: On macOS, it uses a combination of
securitycommand-line tool (which requires user password, but can be tricked via phishing overlay) or exploits a known CVE in keychain access. On Windows, it dumps credentials from Windows Credential Manager and DPAPI master keys. This gives it access to Wi-Fi passwords, enterprise VPN credentials, and—most critically—the private keys stored in Exodus, Electrum, and other non-browser wallets.
- Telegram Session Hijacker: This is the genius move. The malware steals the
tdatafolder from Telegram Desktop. That folder contains the session token. With that, an attacker can log into your Telegram account without 2FA. They can now impersonate you to your colleagues, your DAO co-members, your investors. They can exfiltrate more sensitive data from group chats. This is the gift that keeps on giving.
But it gets worse. The malware also installs a keylogger and a screenshot module. It monitors for any entry of seed phrases or private keys—even if you type them manually. And it exfiltrates data via encrypted DNS tunneling (DoH), making it hard to detect with standard network monitoring.
Data analysis: SlowMist identified the C2 server IP and associated domains. We've cross-referenced these with our exchange's threat feeds. The C2 is hosted on a bulletproof provider in Eastern Europe. The domain registration email traces back to a known cybercrime forum handle. The malware's compilation timestamps suggest it was built in early June 2025—meaning the attackers spent at least a month on reconnaissance.
The implications are profound: This isn't a lone hacker. This is a team. They understand the Web3 ecosystem intimately. They know that the weakest link is not the smart contract, but the private key management on a professional's laptop.
Contrarian: What Everyone Is Missing
Here's the contrarian angle that the security community isn't shouting loudly enough: This attack proves that the entire DeFi security paradigm is misaligned. We spend billions auditing smart contracts, yet the average Web3 developer or protocol lead stores their keys on a laptop that runs shady meeting apps. The narrative that 'code is law' is shattered when the code is malware.
Meanwhile, VCs are funding yet another L2 interoperability solution. They talk about 'liquidity fragmentation' as if that's the industry's biggest problem. No. The real bottleneck is human security. Every new L2, every cross-chain bridge, every new DeFi primitive expands the attack surface—but it all collapses if one private key leaks.
And here's the kicker: USDC's 'compliance-first' model is actually a liability here. Circle can freeze any address within 24 hours, but that assumes the victim knows they've been hacked within 24 hours. The malware is designed to be stealthy. It steals credentials and session tokens, then waits. The attacker might not drain wallets immediately. They might wait weeks to avoid triggering fraud detection. By then, the funds have been laundered through Tornado Cash or cross-chain bridges. USDC freeze is useless.
What everyone is missing is that this attack vector will evolve. Next version: deepfake video interviews. They already have your voice from Telegram calls. They'll synthesize a fake recruiter face. Trust will become the ultimate scarce resource.
Takeaway: The End of Trust as We Know It
The future of Web3 security isn't in more audits or more composability. It's in hardware root of trust. It's in isolated interview environments—dedicated virtual machines that get wiped after each call. It's in biometric verification for recruiters. It's in trusting nothing that can be downloaded.
Are you still running a hot wallet on your workstation?
The attackers are already adapting. The next wave will be here before you finish reading this. The question is: will you be ready?
Satoshi's real vision wasn't just peer-to-peer cash; it was a system where trust is minimized. This scam exploits the trust we still place in people, in platforms, in executables. The cold truth is that the human layer is the last unsecured oracle.