The binary's memory layout reveals a target: your Telegram session key. The malware doesn't just scrape browser cookies—it hunts for the encrypted session file in %APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8C. On macOS, it reads ~/Library/Application Support/Telegram Desktop/tdata. The code never lies, but the auditors do.
This is not a routine phishing email. This is a surgical strike against Web3 professionals, disguised as a legitimate hiring process. On July 29, 2025, SlowMist disclosed a new attack vector: a fake AI meeting tool called "Relay" distributed by attackers posing as recruiters. The victims are wallet developers, DeFi researchers, and protocol engineers—people who hold the keys to millions. The attackers understand the industry's obsession with efficiency and automation. They weaponized it.
Context: The Hype Cycle of Trust
Web3 recruitment has always been a trust game. Teams hire remotely, often without formal KYC, relying on GitHub profiles, Twitter reputations, and referrals. The ecosystem's talent shortage created a vacuum. Attackers filled it with a social engineering scheme that exploits two narratives simultaneously: the AI productivity boom and the job market's desperation.
The attack chain is simple but devastating. A target receives a LinkedIn message or email from a "recruiter" claiming to represent a prominent protocol. They schedule a video interview. The recruiter sends a calendar invite with a link to download "Relay"—a proprietary AI meeting scheduler allegedly used by the hiring team. The link serves a binary compiled for both macOS (.app) and Windows (.exe). The victim installs it, expecting a seamless interview experience. Instead, the installer drops a stealer payload.
From my years of auditing smart contracts and tracing stolen funds, I've seen one constant: human trust is the most exploited vulnerability. This attack is the physical manifestation of a zero-day in human psychology.
Core: The Mechanical Autopsy
SlowMist's sample analysis revealed a malware family we'll call "RecruitStealer" (not an official name, but descriptive). I examined the decompiled code to understand its operational efficiency. The malware is not a one-off script—it's a modular framework with three distinct phases: reconnaissance, exfiltration, and persistence.
Phase 1: Reconnaissance Upon execution, the malware scans the system for high-value targets. It enumerates browser storage (Chrome, Brave, Firefox) and extracts saved credentials, autofill data, and cookies. But the critical focus is on crypto wallet extensions. RecruitStealer checks for over 30 browser extension IDs, including MetaMask, Phantom, Keplr, Rabby, and Coinbase Wallet. It reads the extension's localStorage and IndexedDB files, which often contain encrypted private keys or seed phrases if the user has not locked the wallet. Math doesn't lie, but humans do—most users leave their wallets unlocked for convenience.
Phase 2: Exfiltration The malware prioritizes three data silos: browser-stored private keys, macOS Keychain entries, and Telegram session tokens. The Telegram token is particularly dangerous because it grants persistent access to the victim's account without requiring 2FA. Attackers can then impersonate the victim to their contacts—other Web3 professionals—perpetuating the scam. The exfiltration uses HTTPS POST requests to a C2 server hosted on a bulletproof hosting provider. The traffic is encrypted with a hardcoded TLS certificate to evade detection.
Phase 3: Persistence RecruitStealer installs a scheduled task on Windows (via Task Scheduler) and a LaunchAgent plist on macOS. This ensures the malware survives reboots. It also attempts to disable common endpoint detection tools by terminating processes like CrowdStrike.exe and CarbonBlack.exe. Trust is a vulnerability with a capital T—the attackers assumed the victims would not be running EDR on personal devices, which is almost always true.
To quantify the risk: if a victim had a hot wallet installed and unlocked, the probability of private key exfiltration approaches 100%. Even if the wallet was locked, the malware can capture the master password via a keylogger included in the payload. The only effective mitigation is a hardware wallet that never exposes private keys to the system software.
Contrarian: What the Bulls Got Right
The counter-intuitive truth: this attack validates the need for decentralized identity (DID) and verifiable credentials. The bulls argue that Web3 will eventually eliminate the need for trust in intermediaries like recruiters. They are correct, but not for the reasons they think. The attack's success hinges on the victim's inability to cryptographically verify the recruiter's identity. If the protocol had issued a DID to the recruiter and required a signed message to prove employment, the scam would collapse.
Furthermore, the rapid disclosure by SlowMist demonstrates that the security community can respond faster than the attackers can scale. Within 48 hours of the first report, indicators of compromise (IOCs) were shared publicly. This is a testament to the industry's maturity. The bulls also point to the positive side effect: increased demand for hardware wallets and cold storage solutions. Ledger and Trezor will likely see a spike in sales. The market is inefficient at pricing security risk, but after events like this, it recalibrates.
However, the bulls underestimate the adaptability of state-level attackers. The current malware is amateurish compared to APT-grade variants that could deploy zero-day exploits to bypass even macOS's System Integrity Protection. If this attack vector is adopted by well-funded groups, the mitigation advice becomes obsolete.
Takeaway: The Exit Liquidity Is Always Someone Else's
The next phase of this attack will involve deepfake video calls. Attackers will synthesize the face and voice of a real protocol executive during the interview. Victims will be asked to install a "secure interview environment" that is actually a full remote access toolkit. The industry's response must be proactive: adopt hardware-backed identity verification for all professional interactions. The code never lies, but the auditors do—and in this case, the auditor is your own skepticism.
I don't do FUD, but I do data. The data says: if you are a Web3 professional actively job hunting, assume every unsolicited recruiter is a threat actor until proven otherwise. Verify the job posting on the official company website. Demand a video call on a trusted platform like Zoom or Google Meet. Never install third-party software for an interview. Your wallet is watching, and it demands a secure execution environment.
The exit liquidity is always someone else's—until it's yours. This attack turns that adage into a literal transfer of private keys. The only way to break the cycle is to treat every new connection as a potential vulnerability. Chaos is just data you haven't analyzed yet.