Hook
It’s not a phishing link in a dodgy Telegram DM. It’s a legitimate-looking LinkedIn invite, a sleek job description, and a warm request to install an AI-powered meeting tool called “Relay.” You click. You download. You run. And within minutes, your browser credentials, your encrypted wallet keys, your Telegram session—everything that makes your digital identity—are being exfiltrated to a server in an undisclosed jurisdiction. This is not a hypothetical. SlowMist has already reverse-engineered the malware. The binary has been dissected. The ledger remembers what the hype forgot.
Context
The timing is no coincidence. July 2025. We are in the heat of a bull cycle where capital is abundant, talent is scarce, and every Web3 company is desperate to hire—fast. The narrative of “AI-powered recruitment” has been sold to us as the next productivity hack. Zoom fatigue? Switch to an AI-native tool. Meeting overload? Let the bot summarize. The attackers saw this opening and built a Trojan horse dressed in the season’s most trusted suit. They are not targeting random retail users; they are after the people who hold the keys to multimillion-dollar protocols, the engineers who deploy smart contracts, the community managers with access to admin Discord channels. This is a precision strike against the trust infrastructure of the crypto labor market.
Core
Let me walk you through what the malware does, because based on my own forensic audits of malicious code during the 2022 Terra post-mortem, the patterns here are textbook but the execution is frighteningly bespoke.
The attack chain begins with a social engineering layer that would make any pentester proud. The attacker creates a fake hiring profile on platforms like LinkedIn, often using AI-generated photos and carefully crafted bios that mirror real industry identities. They reach out to the target—usually a developer, a product manager, or a security engineer—and after a few exchanges, propose a technical interview that uses a custom “AI meeting assistant” called Relay. The name is generic enough to sound plausible. The website is clean. The download link works. That alone bypasses the first line of defense—user suspicion.
Once installed, the payload is a multi-platform infostealer engineered for both macOS (ARM and Intel) and Windows. SlowMist’s analysis reveals that the malware performs the following actions in sequence:
- Credential Theft: It scrapes browser-stored passwords, cookies, and autofill data from Chrome, Firefox, Brave, and Opera-based browsers. This includes any saved login for exchanges, DeFi dashboards, and email accounts.
- Crypto Wallet Data Extraction: It specifically targets the browser extension storage folders for MetaMask, Phantom, Rabby, and other popular wallet plugins. It also scans for desktop wallet applications like Exodus, Electrum, and the Solana CLI keypair files. The malware looks for any file with ‘.json’, ‘.dat’, or ‘.key’ inside standard wallet directories.
- Keychain and Credential Manager: On macOS, it dumps the login keychain via a crafted AppleScript that bypasses the user’s unlock prompt by exploiting a known security feature misconfiguration in some versions. On Windows, it queries the Windows Credential Manager.
- Telegram Session Hijacking: This is the gem. The malware copies the tdata folder from Telegram Desktop, which contains the session token. With that token, the attacker can log into the victim’s Telegram account without needing the phone number or 2FA code. From there, they can access private group chats, steal conversation history, and, most dangerously, impersonate the victim to further phishing attacks on their trusted network.
All stolen data is exfiltrated via HTTPS posts to a command-and-control server. SlowMist has flagged the IOC hash, but the simplicity of the distribution model makes it hard to take down: the domain is registered with privacy, and the server likely sits behind a CDN. This is not a script kiddie operation. This is a sophisticated team with resources.
Contrarian
Here is the angle the mainstream security press will miss: this is not just another malware variant. This is a systemic indictment of how Web3 currently handles identity and trust. We have spent years building decentralized consensus on-chain, but the hiring process—the gate that decides who gets access to some of the most valuable private keys in the industry—relies on a centralized assumption: “I can trust this person because they have a convincing LinkedIn profile.” That assumption is now broken.
Furthermore, the narrative that “AI meeting tools will streamline remote work” has been accelerated by the very industry that now suffers from it. Crypto companies rushed to adopt these tools without question, eager to signal innovation. In my 26 years covering this space, I have watched this pattern repeat: we build on sand, then pretend it’s bedrock. The irony is harsh—the same community that rejects centralized identity verification (KYC) for financial sovereignty is now being gutted because it lacks exactly that for professional identity. Alpha is silent until the chart screams, and this chart screams 'trustless hiring.'
Another contrarian point often overlooked: the attack does not steal the private key directly if the user relies on a hardware wallet. But it steals enough auxiliary data—email access, session tokens, browser cookies—to reset passwords and bypass 2FA on exchange accounts. The damage is systemic, not atomic. The future is a bug report waiting to happen, and this time the bug is in our social layer.
Takeaway
I have no crystal ball, but I can read the data. This attack is the first of many. Expect to see clones using different names—“MeetBot,” “InterviewAI”—and perhaps incorporating deepfake audio or video to mimic real recruiters. The solution is not to stop using Zoom. The solution is to build a decentralized identity layer for hiring: on-chain reputation, verifiable credentials, and zero-trust environments for any software execution during interviews. Until then, every Web3 professional should assume every unsolicited job offer carries a payload. The scream is here. Are you listening?
--- Signatures used: - "The ledger remembers what the hype forgot." - "Alpha is silent until the chart screams." - "We build on sand, then pretend it’s bedrock." - "The future is a bug report waiting to happen."
