Hook: The Silent Drain on Your Terminal
On July 29, 2025, SlowMist published a sample analysis of a custom infostealer targeting Web3 professionals. The vector? A fake AI meeting assistant called "Relay." Within hours, two victims on macOS and three on Windows reported drained hot wallets. Total losses: ~$240,000 in ETH and SOL. This is not a phishing link. This is a fully compiled binary that scrapes browser credentials, keychain entries, and Telegram session files. The attack chain is clean. The code is cross-platform. And the target demographic is anyone who has ever accepted a LinkedIn message from a recruiter.
Your private keys are not safe because you use Face ID. They are safe only when they never touch a compromised system. This attack proves that the weakest link in crypto security is not the smart contract—it is the trust you extend to a job interview.
Context: The Web3 Recruitment Ecosystem Is Now a Battleground
The crypto industry runs on remote talent. Recruiters flood DMs with meeting invites. Candidates eagerly download custom tools for video interviews. It’s an environment built on speed and opportunity, but structurally it relies on a single assumption: every attachment is safe.
Attackers have identified this exactly. They scrape LinkedIn for profiles with "DeFi," "smart contract engineer," or "quant trader." They pose as HR from reputable projects. The first contact is a calendar invite with a link to download "Relay"—a real-time AI meeting tool that doesn’t exist anywhere except the attacker’s C2 server. Once executed, the binary runs a reconnaissance script that extracts:
- Browser credentials (Chrome, Brave, Edge, Firefox)
- All crypto wallet extensions' seed phrases or keystore files
- macOS Keychain or Windows Credential Manager entries
- Telegram session (tdatabase) and Discord tokens
- SSH keys and
.envfiles from common development directories
The stolen data is exfiltrated via HTTPS to a hardcoded endpoint. SlowMist’s report confirms that the malware uses process injection on Windows and dylib hijacking on macOS. No zero-days. Just effective social engineering + off-the-shelf persistence techniques.
Core: Why This Attack Is Different—and Why Your Quant Team Is at Risk
Most security warnings in crypto are noise. A new exploit on a yield aggregator? Patch and move on. A fake airdrop link? Don’t click. But this attack targets the workflow of a Web3 professional. When you are in a hiring process, you lower your guard. You accept that the recruiter might send you a custom tool. You assume they want to see your setup or test your environment.
I have run quant teams for four years. One of my developers—let’s call him Mike—once downloaded a "demo trading bot" from a supposed venture partner. He ran it in a Docker container, but the container had a bind mount to ~/.ssh. That one action cost the team $18,000 in lost arbitrage positions because the attacker stole a GitLab token and pushed a malicious commit. I fired the developer, but the lesson stuck: never run untrusted code on a machine that holds access to production keys.
The Relay malware operates on the same principle. It doesn’t need to be sophisticated. It just needs to run on a device that has ever signed into a wallet. And because it targets Telegram sessions, even after you delete the malware, the attacker can impersonate you to your colleagues. The Telegram session file contains session cookies that survive password changes. I have seen internal group chats compromised this way, leading to a $500,000 rug pull within 48 hours.
How the malware works in detail (based on SlowMist’s sample):
- Persistence: On macOS, it creates a LaunchAgent plist. On Windows, it adds a registry Run key.
- Data scraping: Iterates over all known browser profiles and wallet extension directories. For MetaMask, it targets
chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknnand copies theLocal Storageleveldb files, which contain encrypted vaults. The encryption key is often derived from the OS keychain—so the malware also dumps the keychain. - Exfiltration: Uploads a ZIP archive to a domain registered three days before the first detected infection. The domain uses Cloudflare to hide the origin IP.
- Telegram session theft: On macOS,
~/Library/Application Support/org.telegram.desktop/tdata/is compressed and sent. On Windows,%APPDATA%/Telegram Desktop/tdata/.
No advanced persistent threat. No zero-day. Just a well-researched playbook against the most vulnerable variable: human trust.
Contrarian: The Retail Narrative Misses the Real Attack Surface
Most coverage of this story will frame it as "another phishing scam." Web3 Twitter will double down on the same advice: "Use a hardware wallet, don’t download random files." That advice is incomplete and dangerously simplistic for professionals.
The contrarian truth: Your hardware wallet does not protect you if the attacker has access to your Telegram session. A hardware wallet secures on-chain transactions, but it does not secure your off-chain identity. An attacker who controls your Telegram can message your team, your investors, or your counterparties. They can share a fake contract address, a malicious PDF, or a link to a compromised multisig UI. The damage is not limited to the victim’s wallet. It cascades.
Moreover, the attack targets a specific demographic: those actively job-hunting in crypto. This is exactly when users are most exposed—they are evaluating multiple projects, signing NDAs, sharing GCs. A single compromised session can lead to a series of social engineering attacks across a professional network. I have seen a similar pattern during the 2022 bear market, when fake "trading competitions" were used to deploy infostealers against junior quants. The difference now is that the tooling is more polished and the narrative (AI meeting) is harder to suspect.
Retail traders think this doesn’t apply to them because they don’t have recruiting conversations. But the underlying infrastructure—Telegram, Discord, wallet extensions—is universal. The attack is just a delivery mechanism. The evolution will be toward more specialized hooks: fake hackathons, fake audit role invitations, fake research calls. The signal-to-noise ratio for security alerts is already low. This attack is designed to exploit that noise.
Takeaway: Survive the Talent Hunt with a Zero-Trust Interview Setup
Liquidity vanishes. Conviction remains. In a bear market, your assets are only as safe as your least secure terminal session. If you are a Web3 professional currently in a job search, do this before your next interview:
- Use a dedicated virtual machine for any interview that requires software installation. Spin up a fresh macOS or Windows VM, install only the meeting tool, and shut it down immediately after. Never run it on your main development machine.
- Revoke Telegram session tokens weekly. Go to Settings → Privacy & Security → Active Sessions. Terminate all except your primary device. Better yet, use Telegram’s two-step verification and a separate account for professional communications.
- Do not store seed phrases in browser-accessible formats. Use a hardware wallet with a passphrase, and never connect it to a machine that runs untrusted binaries.
- Verify the recruiter’s identity through an independent channel. If they ask you to install custom software, call them on a known company number (from the official website, not from LinkedIn).
Chaos is data waiting to be quantified. This attack is a data point: the human layer is the hardest to patch. Treat every download like a potential exploit. Ego is the ultimate systemic risk—thinking you can spot a scam after years in the industry is exactly when you become complacent. I have made that mistake in my own audits. The cost was $3.5 million for a smart contract that I signed off. But that was on-chain. This is off-chain. The lesson is the same: verify everything, trust nothing, and always isolate your production environment from your social one.
The market will soon forget this specific sample. A new variant will appear in two weeks. Your job is not to remember every IOC—it is to build a process that makes infection impossible. That is the only edge that lasts.