On July 29, 2025, SlowMist published a post-mortem on a new infostealer. The malware masquerades as 'Relay' – an AI-powered meeting tool for remote interviews. But this isn't a normal job scam. The attackers targeted Web3 professionals specifically. They crafted fake recruiter profiles, scheduled interviews, and asked candidates to install 'Relay' before the call. Once installed, the malware exfiltrates browser credentials, crypto wallet data, macOS keychain entries, and Telegram session tokens. I've seen phishing before. This is different. This is a surgical strike on the crypto workforce.
Remote hiring in crypto is the norm. Security teams often rely on video calls and collaboration tools. Attackers know this. They exploit the urgency of job seekers in a bear market. With hiring freezes across the industry, candidates are eager to prove themselves. The 'Relay' malware exploits that desperation. It exists in two variants: one for macOS, one for Windows. That alone signals a mature threat actor. Most phishing campaigns target Windows only. Cross-platform development requires resources. SlowMist's analysis reveals the malware is a custom build – not a repurposed commodity stealer. It collects data from Chrome, Firefox, Brave, and other browsers. It grabs private keys from browser-based wallets like MetaMask. It accesses the macOS keychain for additional passwords. Telegram sessions are stolen to hijack ongoing conversations. This allows the attacker to impersonate the victim and spread the malware to their contacts. The attack chain is complete: from fake job offer to full wallet compromise.
Let's break down the technical specifics. The malware surfaces as a .dmg file on macOS and an .exe on Windows. Its file size is small – under 5MB – to avoid detection. It uses code obfuscation to bypass signature-based antivirus. After installation, it connects to a command-and-control server. The C2 infrastructure is likely hosted on a bulletproof provider. The malware then enumerates the victim's browser profile directories. It looks for Local State files, Login Data, and extension folders. For MetaMask, it extracts the vault seed phrase if the wallet is unlocked. For hardware wallets, it can't directly extract keys, but it can capture the browser's communication with the device. That means even Ledger users are at risk if they confirm transactions through the browser extension. The key insight: this malware targets the 'hot' interface between user and wallet, not the cold storage itself.
Based on my experience tracing ICO wallet clusters in 2017, I recognize the precision. The attackers didn't just cast a wide net. They researched their targets. They likely scraped LinkedIn for crypto job postings and filtered for professionals with public wallet addresses or NFT portfolios. The social engineering is textbook. The recruiter persona is convincing – they use real company names, professional bios, and even fake interview questions. One victim reported a two-hour 'interview' where the attacker asked technical questions about Solidity while the malware ran in the background.
The malware also steals Telegram session data. This is critical. Telegram is the hub of crypto communication. Many teams rely on Telegram for internal coordination. With a stolen session, an attacker can read private groups, impersonate the victim to colleagues, and request payments or seed phrases. SlowMist identified that the stolen session tokens are sent to a separate channel. This means the attackers can maintain persistent access even after the victim deletes the malware.
SlowMist has shared indicators of compromise: specific file hashes, registry keys, and C2 domains. They recommend users check for these IOCs immediately. But the real lesson is procedural. No legitimate recruiter will ask you to install custom software before an interview. Standard tools like Zoom, Google Meet, or Telegram are sufficient. The 'AI meeting tool' narrative is a red flag.
I've analyzed on-chain flow data for years. I can trace stolen funds. But in this case, the theft often doesn't show up on-chain until days later. The attackers wait for the victim to interact with their wallet naturally. That could be a day, a week, or a month. The malware just sits there, capturing keystrokes and clipboard data. Chaos is just data waiting for the right query – but by then, the funds are gone. Yields don't justify risky installations – but this attack proves that bear market desperation overrides caution.
Common wisdom says: use a hardware wallet and you're safe. This malware disproves that. If you connect your Ledger to your browser and interact with a dApp while infected, the malware can observe the transaction and modify it before you confirm. The Ledger screen shows one address, but the actual transaction goes elsewhere. Users rely on 'what you see is what you sign.' This malware breaks that trust.
Another blind spot: Mac users think they're immune. 'Macs don't get viruses' is a myth. This malware proves that the crypto industry's macOS reliance is a vulnerability. Many developers and founders use MacBooks for security. Attackers now target that precisely.
The narrative that 'AI tools improve productivity' is weaponized here. The same industry that rushes to integrate AI is now vulnerable to AI-themed scams. Trust the hash, not the headline. The code matters more than the product name.
This is not a drill. If you are a Web3 professional actively job hunting, isolate your job search to a separate device or a virtual machine. Never install unverified software. Use a hardware wallet with a dedicated browser – or better, sign transactions from a mobile app. The next 'Relay' variant will be harder to detect. The blocks remember every transaction that follows a compromised session. Your job is to make sure your wallet never signs one.