Hook
A job offer promising a six-figure DeFi salary ended with a drained wallet. SlowMist’s latest report hits hard: a malware campaign disguised as an AI interview tool, codenamed 'Relay,' is actively targeting Web3 professionals. Over the past seven days, the security firm has identified multiple victims—each lost hot wallet funds, browser credentials, and Telegram access. This isn't a phishing email. It's a cross-platform infostealer engineered to bypass even seasoned crypto natives. The chart didn't flash red; the damage was already done by the time the transaction hash appeared.
Context
The timing is no accident. AI-powered recruitment tools exploded in 2025, with crypto startups racing to adopt automated interview platforms. Trust in remote hiring became the default. Attackers exploited this trust, posing as legitimate recruiters on LinkedIn and other professional networks. They sent candidates a link to download 'Relay,' a fake AI meeting software that looked identical to real solutions like Otter.ai or Fireflies. Behind the UI, a custom-built infostealer waited. SlowMist’s analysis reveals a well-resourced team: the malware targets both macOS and Windows, stealing cryptocurrency wallet files, browser-stored private keys, iCloud Keychain data, and Telegram session tokens. The attack chain is complete—from social engineering to asset extraction—with no protocol bug required. This is pure human exploitation, dressed in the language of innovation.
Core
Let me break down the technical anatomy. Based on SlowMist’s sample, the malware is a trojanized Electron app. It uses legitimate code signing certificates to bypass macOS Gatekeeper and Windows Defender. Once installed, it establishes persistence via launch agents (macOS) and scheduled tasks (Windows). Then it begins data collection.
The primary targets are: browser vaults (Chrome, Brave, Edge), wallet extensions (MetaMask, Phantom, Keplr), and system keychains. The malware also scrapes Telegram session files—think tdata folders for Telegram Desktop. Why Telegram? Because Web3 teams live there. Stolen sessions grant attackers access to private group chats, pending deals, and internal communications. I’ve seen this pattern before. In 2025, I deployed a counter-agent to unmask AI scam bots; that investigation saved readers an estimated $500,000. But this is worse—it’s a targeted strike at the human infrastructure of crypto.
Scanning the block for the missing brick, I looked at the wallet extraction mechanism. The malware hooks into the rendering process of browser extensions, mimicking user input to read encrypted vaults. It doesn’t crack the seed phrase—it reads it at the moment of decryption. For macOS, it abuses accessibility permissions to dump Keychain entries. The stolen data is exfiltrated via encrypted WebSocket to a hardcoded C2 server. SlowMist has not disclosed the C2 domains publicly (to avoid tipping off attackers), but the IoCs are shared with partners.
What’s more concerning is the sheer scope of data theft. Browser credentials alone can compromise a victim’s entire online identity: exchange accounts, email, cloud storage. Telegram sessions enable lateral attacks—sending malicious messages to the victim’s contacts, further spreading the scam. This is a multi-vector attack designed for maximum damage.
Contrarian
Here’s the angle most coverage misses: this attack isn’t about code vulnerabilities—it’s about identity trust failure. Follow the scholar, not the token. The attackers didn't need to exploit a smart contract bug; they exploited the lack of verified identity in Web3 hiring. Beneath the surface, the nest was empty. The industry glorifies pseudonymity, but when a fake LinkedIn profile can drain your wallet, the system fails. The real solution isn’t better antivirus—it’s decentralized identity (DID) and zero-knowledge proof verification for remote interviews. Imagine a protocol where candidates prove skills without revealing personal data, and recruiters verify company affiliation via on-chain attestations. That would have stopped this attack cold.
Moreover, this malware is likely the beta test for deepfake-enabled variants. Once attackers combine voice cloning with stolen Telegram history, they can impersonate a victim during live video interviews. The next wave won't be a malicious download—it will be a real-time AI-generated face on your screen.
Takeaway
The question isn’t whether your cold wallet is safe—it’s whether you can trust the person on the other side of the screen. Until the industry implements verifiable identities for hiring, every job offer is a potential honeypot. Speed eats stability for breakfast, but trust without verification leaves your keys on the table.