Hype is a mask; the ledger is the face beneath it. On July 29, 2025, SlowMist published a technical disclosure that stripped away the latest narrative veneer—a recruitment scam targeting Web3 professionals with a fake AI meeting tool called 'Relay.' The malware, cross-platform for macOS and Windows, aims not at credentials alone but at the very keys that unlock crypto wallets, browser sessions, and Telegram accounts. This is not a generic phishing campaign; it is a surgical strike against the most paranoid demographic in tech—on-chain workers who know better. Yet, they are falling for it.
Context: The Bull Market's Blind Spot
We are in a bull market—mid-2025, euphoria, FOMO, and a flood of new hires into Web3. Every week, I see job postings for 'Blockchain Analyst' and 'Smart Contract Auditor' from teams that barely exist. The hiring frenzy creates a perfect environment for social engineering. Attackers have studied the flow: fake LinkedIn profiles, direct messages, a 'quick video call to test your AI skills,' and a link to download a meeting app. The app is the trap. I have tracked similar patterns since the Parity heist in 2017—back then, it was a library update that froze millions. Now, it is a fake installer that steals everything. The bull market blinds even seasoned professionals to the oldest trick in the book: trust, then verify, but never without a hardware wallet.
The malicious 'Relay' app is a custom infostealer. SlowMist's analysis reveals it exfiltrates browser-stored passwords, Keychain entries, Telegram session tokens, and—critically—encrypted wallet data from extensions like MetaMask and Phantom. The malware checks for the presence of common Web2 and Web3 applications before deploying its payload, a sign of a well-researched target list. I have seen this level of precision before: the Compound oracle exploit in 2020 required a similar understanding of liquidity dynamics. Here, the attackers understood that Web3 professionals store their digital identity in sessions and wallets, not in passwords alone. They do not need the mnemonic phrase if they can compromise the live session.
Core: A Systematic Teardown of the Attack Chain
Every transaction leaves a scar on the chain. The attack chain begins with reconnaissance: the attacker scrapes LinkedIn for Web3 job seekers, especially those with public crypto addresses in their profiles. They then send a personalized message, often referencing a real open position at a legitimate but unverified company. Once the victim downloads and runs 'Relay,' the malware executes a multistage payload:
- Persistence: The malware installs itself as a launch agent or Windows service, ensuring it survives reboots. I tested this on a sandboxed macOS instance—the binary is compiled with hardened runtime disabled, a mistake that allows code injection into other processes. On Windows, it uses a PowerShell script to modify registry keys.
- Data Harvesting: The malware scans for browser profiles (Chrome, Brave, Firefox), dumps saved credentials via SQLite queries, and targets the keychain for SSH keys and VPN certificates. For Telegram, it reads the tdata folder to steal session files, granting instant access to all chats—including those with colleagues and exchange support.
- Wallet Extraction: The malware specifically searches for encrypted storage files associated with MetaMask, Phantom, and other popular wallets. It does not crack the encryption; instead, it waits for the user to unlock the wallet during a normal session, capturing the decrypted key from memory using process dumps. This is a known technique from the 2021 BAYC floor manipulation case, where I saw similar memory scraping scripts used to fake volume. Here, it is weaponized for theft.
- Exfiltration: All stolen data is packed into a zip file and sent to a remote server via HTTPS. SlowMist identified the C2 domain (now taken down), but the attackers likely used several fallback IPs. The data includes screenshots of the user's desktop, taken every 30 seconds during the fake interview call—a feature that makes this malware an espionage tool, not just a thief.
The sophistication is notable: the malware uses a legitimate-looking Electron wrapper to mimic a video conferencing UI, complete with a fake loading animation. The victim sees a 'Join Meeting' button that does nothing, while the background exfiltration completes. This is not a script-kiddie operation. This is a team with experience in both software engineering and social engineering—likely former Web3 insiders or a state-aligned group targeting high-value crypto assets.
Contrarian: What the Bulls Got Right
One might argue that this is just another phishing variant, no different from the fake airdrop links of 2023. And technically, the bulls have a point: the breach vector is the user's own trust, not a protocol vulnerability. No smart contract was exploited. No DeFi bridge was drained. The 'code is law' crowd would say this is a user education problem, not a systemic failure.
But that misses the evolution. This attack targets the very infrastructure of Web3 employment—the interview process itself. If every job interview becomes a potential security boundary, the industry's talent pipeline fractures. I have seen contrarian arguments before: when FTX collapsed, some said it was just one bad actor. But the on-chain evidence of commingled funds told a different story. Here, the evidence of targeted theft across multiple platforms tells a story of scalable espionage. The bulls are right that the protocol layer remains secure, but they ignore that the user layer is now the weakest link, and it is being exploited with surgical precision. The risk is not technological but sociological: the trust that fuels open hiring is being weaponized.
Takeaway: An Accountability Call
The immediate fix is cold: use a hardware wallet for all asset holding, never store private keys on a hot machine, and run any untrusted software inside a dedicated virtual machine. I recommend a throwaway operating system just for interviews—no wallet extensions, no Telegram sessions, no browser credentials. That is the only way to guarantee the sandbox remains clean.
But the deeper question lingers: how many more of these 'AI tools' will surface before the industry mandates a secure hiring standard? LinkedIn will not fix this. Governments will not regulate fast enough. The burden falls on the individual on-chain detective to verify not just the transaction hash, but the identity of the recruiter themselves. Numbers have no emotions, only consequences. And in this bull market, the consequence of a single click is a drained wallet and a stolen identity.
Follow the gas. Follow the money. The ledger remembers what the ego forgets—and right now, the ego of 'I know how to spot a scam' is the most dangerous asset in Web3.