The code bleeds, but the liquidity stays cold. That's the mantra I repeat when I see a new exploit surface. Today's isn't a smart contract bug—it's a fake AI interview tool designed to bleed Web3 professionals dry. SlowMist's latest analysis reveals a malicious binary disguised as 'Relay' meeting software, targeting both macOS and Windows users. Over the past 72 hours, at least three high-profile wallets have been drained. This isn't a theoretical risk. It's live, and it's targeting the very people who trade crypto for a living.
Context: The Attack Chain
The setup is disturbingly simple. An attacker crafts a convincing LinkedIn profile, posing as a recruiter for a well-known Web3 protocol. They engage a target—often a developer or trader—and propose a 'technical interview' to assess fit. The recruiter sends a download link for 'Relay,' an AI-powered meeting tool promising optimized audio and video. The target installs the executable. Within seconds, the malware begins exfiltrating browser cookies, stored passwords, cryptocurrency wallet files, macOS keychain entries, and Telegram session tokens. By the time the victim realizes the interview was a sham, their assets are already moving through a mixer.
This isn't a spray-and-pray attack. The attacker deliberately targets individuals who likely hold significant crypto assets and use hot wallets for daily operations. Based on my experience reverse-engineering the DAO hack vector in 2017, I know that the most devastating exploits are those that weaponize trust. This one weaponizes career desperation.
Core: The Technical Breakdown
Let's dissect this as a trader would analyze a gamma squeeze. The malware's code is cross-platform, compiled from a single codebase—likely Rust or Go—to avoid detection by signature-based antivirus. Once executed, it establishes persistence via launch agents (macOS) or scheduled tasks (Windows). Then it begins harvesting:
- Browser data: Chrome, Firefox, Brave—cookies and autofill credentials for exchanges like Binance, Coinbase, and Kraken.
- Wallet files: Phantom, MetaMask, Ledger Live, and others that store private keys locally.
- Keychain: macOS keychain dumps, which often contain mnemonic phrases.
- Telegram: Session tokens that allow full impersonation in group chats, enabling secondary phishing attacks.
Volatility is the only constant truth. This malware doesn't just steal from one vector; it aggregates a portfolio of credentials. In options, we call a position that moves in multiple directions a 'strangle.' This attack is a strangle on your digital identity. The attacker profits from whichever asset moves—private keys, exchange access, or social tokens.
The malware's network traffic is encrypted and using HTTPS in C2 communication, making it hard to detect via simple DPI. SlowMist's analysis confirms that the binary undergoes runtime unpacking, indicating the attacker has development skills beyond typical script kiddies. This is a sophisticated actor, likely with financial motivation.
Contrarian: The Real Vulnerability Isn't Code
The conventional wisdom says 'use a hardware wallet and you're safe.' That's half-true. A Ledger won't protect you if the attacker obtains your seed phrase via keychain access. But the deeper issue is institutional: LinkedIn and similar platforms have become the trusted backbone of Web3 hiring, yet they offer zero verification of recruiter identity. The attacker exploited this trust gap with surgical precision.
Liquidity is a mirror, not a floor. The mirror here reflects our own cognitive bias: we preach 'don't trust, verify' on-chain, but when a job offer appears, verification goes out the window. This is the same psychological trap that fueled the Terra collapse: belief in narrative over structure. "Trust is a bug in the system," and this attack proves it.
Another blind spot: the industry's obsession with on-chain security obscures endpoint risks. We audit smart contracts for reentrancy, but we click .exe files without a second thought. The next major hack won't come from a DeFi protocol—it will come from a PDF or a meeting link. This attack is a precursor. As deepfakes improve, we'll see variants where the recruiter video-calls with a synthetic face. The attack surface is expanding, and our defenses are still in 2017.
Takeaway: What to Do Now
First, freeze your expectations. No legitimate recruiter will ask you to install a custom meeting tool. Use only major, audited platforms like Zoom or Google Meet—and even then, verify the caller's domain via a phone call. Second, run interviews in a sandboxed environment. I use a dedicated VM that I wipe after each session. Third, never keep large amounts on a hot wallet. If you're actively trading, use a hardware wallet for storage and only transfer what you need to a hot wallet for individual trades.
Audit trails don't execute, people do. This attack will fade from headlines, but the malware will evolve. The market will chop sideways, but this kind of social engineering is a directional bet against human nature. The only hedge is paranoia.
SlowMist's disclosure is a gift—use it to tighten your opsec. The next fake interview could be the one that takes your portfolio to zero. Stay cold.