The next crypto bear market won't be triggered by a failed DeFi protocol. It will be triggered by a fake Zoom link.

I’ve seen this pattern before. In 2017, I leaked a SQL injection audit of a token sale platform that could have drained millions. In 2021, I scraped 10,000 NFT contracts to prove 40% of 'rare' traits lived on centralized servers. Both times, the attack vector wasn't code—it was trust. And now, SlowMist has flagged a new breed of social engineering that weaponizes the AI hiring frenzy against Web3 professionals.

The malicous payload? A fake AI meeting tool called "Relay". The recruitment? A seemingly legitimate job offer from a crypto-native company. The result? Your browser credentials, wallet private keys, macOS Keychain data, and Telegram session tokens exfiltrated to a server controlled by attackers.

This isn’t another phishing page. It’s a full-spectrum info-stealer, compiled for both macOS and Windows. SlowMist’s analysis confirms the attack chain is complete: the malware has been deployed in the wild, and samples are now available for reverse engineering. The clock is ticking for anyone who has received a suspicious interview invite in the last 72 hours.

Context: Why Now?

We are deep in a bear market that markets call a 'recovery'. Hype cycles have shifted from DeFi to AI agents and on-chain recruiting. Every week, another startup touts AI-powered hiring tools. Every week, thousands of developers, traders, and analysts apply for remote roles without a second thought.

Attackers are reading the same headlines. They know that the Web3 workforce is isolated, hungry for opportunity, and conditioned to trust 'innovation'. By branding their malware as an AI meeting copilot, they bypass the skepticism threshold. The fake Recruiter sends a LinkedIn message, a Telegram invite, and a download link. The victim—eager to impress—installs the app. Game over.

This is not a generic exploit. The attackers specifically targeted Web3 professionals. They likely studied the recruiting workflows of prominent crypto firms. They knew that most teams use Telegram for communication, that hardware wallets are common but hot wallets still hold operational funds, and that Keychain stores exchange API secrets.

Core: The Technical Dissection

Let me walk you through the kill chain based on SlowMist’s findings—and what they didn’t say explicitly.

The malware, dubbed 'Relay' for its disguise, is a compiled binary that masquerades as a legitimate meeting software installer. Once executed, it performs the following actions:

1. Credential Harvesting: It scrapes browser databases (Chromium-based: Chrome, Brave; also Firefox) for saved passwords, cookies, and autofill data. This includes exchange logins, email accounts, and social media.
2. Wallet Extraction: It scans for known crypto wallet extensions (MetaMask, Phantom, Rabby, etc.) by accessing extension storage directories. If the wallet is unlocked, the private keys are dumped via injected scripts.
3. Keychain Exploitation: On macOS, it abuses Apple’s Keychain API to retrieve stored passwords, SSH keys, and VPN credentials. This is the silent killer—most developers store their private keys or seed phrases in text files protected only by a weak system password.
4. Telegram Session Theft: It reads the Telegram Desktop client’s session files (tdummy and tdata) to clone the user’s session. Attackers can then impersonate the victim within their entire Telegram network, including private groups and direct messages with colleagues.

What the report hints at but doesn’t confirm: The malware likely employs anti-debugging checks (e.g., detecting VMWare, VirtualBox) to avoid sandbox analysis. It may also use process hollowing or encrypted C2 communication. These are standard for advanced infostealers. The cross-platform execution suggests the attacker has a robust development pipeline—not a script kiddie.

Based on my auditing experience, I can tell you that the hardest part of this attack isn’t the code. It’s the social engineering bridge. The fact that the attackers took the time to build a convincing recruiter persona, craft a realistic job description, and even schedule a fake interview shows a level of sophistication we usually associate with nation-state actors. But this is pure financial greed.

Contrarian: The Blind Spot Nobody Talks About

Everyone is focusing on the malware. That’s the wrong priority.

The real vulnerability is the trust-by-default culture of Web3. We minted dreams of decentralized collaboration, but forgot to code the reality of identity verification. Our entire industry runs on pseudonymous GitHub profiles and Telegram handles. When a 'recruiter' reaches out, there is no cryptographic proof they represent the company. Their LinkedIn profile could be a deepfake. Their email domain could be a spoofed subdomain.

SlowMist’s warning is necessary, but it treats the symptom. The root cause is that Web3 recruiting has zero security standards. No end-to-end encryption for job offers. No authenticated identity layer for interviews. No sandboxed environment for running candidate-provided software.

Here’s the contrarian take: The biggest winner from this attack won’t be security vendors. It will be the traditional video conferencing incumbents—Zoom, Google Meet, Microsoft Teams. Why? Because they are already trusted, already installed, and already on everyone’s whitelist. The attack weaponizes AI buzzwords, but the defense will be boring, centralized, and KYC-d.

And the second blind spot: this attack will spread. The source code for this infostealer will likely appear on dark web forums within weeks. Copycats will rebrand it as "AI Resume Analyzer" or "Crypto Tax Tool". The signal is hidden in the noise you ignore—the next wave will look even more legit.

Takeaway: Your Defense Is a Locked Door

Your hardware wallet can’t protect you if you type your seed phrase into a fake Google Form. Your antivirus can’t stop a binary you willingly executed. Your trust in 'Web3 values' won’t refund your stolen ETH.

Do this now: - If you’ve received a recruiter message with an unsolicited software download link in the last 7 days, quarantine that machine immediately. - Rotate all Telegram tokens (Settings → Privacy & Security → Sessions). Revoke every session except your current one. - Change your browser saved passwords—especially for exchanges. - For future interviews: insist on using the company’s official meeting platform (Zoom, Google Meet). If they propose an unknown tool, demand a written confirmation via an alternative channel.

Every crash is just a forgotten lesson rebranded. The 2017 ICO mania taught us to distrust whitepapers. The 2021 NFT chaos taught us to distrust rarity charts. The 2022 Terra collapse taught us to distrust algorithmic stablecoins. Now, 2025 is teaching us to distrust a 'simple meeting invite'.

The signal was always there. You just weren’t listening.

Volatility is merely liquidity wearing a disguise. Today, the disguise was a fake Zoom click.