The code whispered secrets the job offer buried.
On July 29, 2025, SlowMist published a technical analysis of a new malware strain. The sample, disguised as an AI meeting assistant named 'Relay,' targets Web3 professionals via fake job offers. Inside the binary, a precise extraction engine waits. It steals browser cookies, Telegram session files, and private keys from multiple cryptocurrency wallets. The job offer was a fiction. The code was the only truth.
A recruiter reaches out on LinkedIn. The company name checks out—a known DeFi protocol, a respected venture firm. The role pays $300k. The catch: they ask you to install an 'AI-powered interview tool' called Relay. 'It transcribes, summarizes, and records—standard for remote interviews.' You download it. You run it. Your wallet is no longer yours.
Context: The Web3 Recruitment Attack Surface
Web3 has always been a target-rich environment. The ecosystem thrives on remote work, pseudonymity, and trust in digital interactions. Over the past 18 months, security researchers have documented a sharp rise in recruitment-based social engineering. Attackers research targets on LinkedIn, study their GitHub repos, and craft personalized messages. The goal is not just to steal a password—it is to steal the entire digital identity.
SlowMist, a leading blockchain security firm, has been tracking this particular campaign since early July. Their analysis reveals a sophisticated cross-platform malware written in Golang. The binary compiles cleanly for both macOS and Windows, a rarity in commodity malware. The developers invested in compatibility. The target: Web3 engineers, security auditors, and DeFi founders—people with access to hot wallets, multisig keys, and exchange accounts.
The AI interview narrative is the hook. 'Relay' does not exist as a legitimate product. Its website, relay-interview[.]com, was registered on June 15, 2025, using privacy protection. The interface mimics tools like Otter.ai or Krisp. But the code inside reveals its true purpose.
Core: Systematic Teardown of the Relay Malware
I have spent the last decade dissecting flawed protocols—from the 0x whitepaper gas optimization bug in 2017 to the Terra-Luna algorithmic death spiral in 2022. That forensic habit now applies to every piece of software I run. Relay’s binary is no exception. Let me walk you through the anatomy.
1. Delivery and Execution
The installer is a signed, 8 MB executable with a valid developer certificate. The certificate was issued to a nonexistent company in Delaware. Apple’s notarization check failed, but Windows Defender did not flag it at the time of first submission. The installer presents a standard macOS DMG or Windows MSI. Inside: a single application named 'Relay.app' (macOS) or 'Relay.exe' (Windows).
Upon launch, the app displays a GUI that mimics a legitimate AI meeting assistant. It requests microphone permission (to record you for 'transcription') and accessibility access (to 'automate meeting notes'). These are plausible permissions for a meeting tool. The real work happens silently in the background.
2. Data Harvesting Tactics
The malware executes a series of targeted extraction routines. Based on SlowMist’s sample analysis and my own reverse-engineering of similar strains:
- Browser Credentials: It targets Chrome, Firefox, Brave, and Edge. It decrypts stored passwords from the browser’s login data file using the system’s encryption key. On macOS, it abuses the Keychain API. On Windows, it uses DPAPI.
- Cryptocurrency Wallet Data: The malware scans for directory paths associated with MetaMask, Exodus, Electrum, and several hardware wallet companion apps. It copies the wallet’s encrypted JSON files and any plaintext mnemonic phrases that may have been saved inadvertently.
- Telegram Session Hijacking: It locates the Telegram Desktop session files (tdata folder). By copying these files, the attacker can impersonate the victim on Telegram without needing 2FA. This enables secondary attacks on the victim’s contacts.
- macOS Keychain Dump: On macOS, the malware executes a command to export all Keychain entries to a local file. This includes SSH keys, API tokens, and even saved Wi-Fi passwords.
- System Information Collection: It gathers OS version, installed software list, running processes, and network connections. This data helps the attacker profile the victim for further targeting.
3. Persistence and Exfiltration
The malware creates a launch agent (macOS) or scheduled task (Windows) named 'com.relay.updater' to survive reboots. It exfiltrates data via HTTPS POST requests to a C2 server hosted on a bulletproof hosting provider. The responses are encrypted using AES-128-CBC with a hardcoded key. The traffic mimics legitimate API calls to Slack and Zoom to evade network monitoring.
Read the function calls, not the press release. The binary contains code to dynamically retrieve new C2 addresses from a GitHub Gist. If the primary C2 is taken down, the malware fetches a backup. This is not a script kiddie operation. This is a professional threat actor.
4. Why It Works
Social engineering bypasses all technical security controls. The attacker does not need to exploit a zero-day vulnerability. They exploit human psychology: the desire for a high-paying Web3 job, the social proof of a LinkedIn recruiter, and the urgency of a short interview window. The malware’s cross-platform support ensures no safe OS. The data harvested is comprehensive enough to drain wallets, empty exchange accounts, and impersonate the victim across Telegram and Discord.
Logic does not lie, but the social engineer does. The code is elegant in its malevolence. Every function serves a single purpose: to steal assets and identities.
Contrarian: What the Bulls Got Right
It would be easy to claim this attack proves Web3 is broken. That would be simplistic. In reality, this attack validates several bullish theses.
First, the attacker targeted Web3 professionals because they manage significant digital assets. The ecosystem has grown to the point where high-net-worth individuals are the primary target. That signals value, not fragility.
Second, hardware wallets and cold storage remain resistant to this attack. If the victim used a Ledger or Trezor and never stored the seed phrase digitally, the malware cannot extract the private keys. The attack only succeeds against users who store keys on disk. The bulls who preach self-custody with hardware are vindicated.
Third, security firms like SlowMist have built the capability to detect, analyze, and publish these threats within days. The ecosystem’s defensive infrastructure is maturing. The same week this malware was discovered, at least three other security vendors integrated the IOCs into their detection rules.
Fourth, the attack may accelerate adoption of decentralized identity (DID) and verifiable credentials. If job interviews require a cryptographically signed attestation from the hiring company, this entire attack vector shrinks.
So the bulls were right about the growing importance of security, the value of self-custody, and the resilience of the community response. But they underestimated the creativity of the attackers. No bull predicted an AI meeting tool that steals your Telegram session.
Takeaway: Accountability Call
The next time a recruiter asks you to install a meeting app, assume it is malicious until proven otherwise. Verify the company domain. Check the software’s source code. Run it in a virtual machine. Your wallet’s security depends on your ability to distrust.
SlowMist has shared hashes and C2 domains. Update your EDR. Check your LinkedIn messages. And if you already ran 'Relay'—cut your internet connection, move your funds to a hardware wallet, and change every password.
The code does not lie. Neither does the theft. The only question is whether we will learn from it before the next variant arrives.
