The Fake Interview That Steals Your Seed: A SlowMist Autopsy

On July 29, 2025, SlowMist published a technical breakdown of a malware disguised as an AI meeting tool called 'Relay.' It targets Web3 professionals. Forty percent of confirmed victims held wallet balances exceeding $100,000 across multiple chains. Logic does not bleed, but code leaves traces. This trace leads to a social engineering campaign that exploits trust in remote hiring—a trust we’ve all been conditioned to extend. The attack vector is deceptively simple. Attackers impersonate recruiters on LinkedIn, often with convincing profiles containing years of fabricated experience. They invite the target to install 'Relay,' an AI-powered interview tool that supposedly analyzes speech patterns and body language. The candidate, eager for a role at a top protocol, downloads and runs the installer. Within seconds, the machine is compromised. SlowMist’s analysis confirms the malware is cross-platform, with native binaries for both macOS and Windows. It steals browser credentials, cryptocurrency wallet extensions (MetaMask, Phantom, Keplr), keychain data, and—most critically—Telegram session tokens. The session token theft is the novel twist. Attackers can now impersonate the victim in private Telegram groups, spreading malicious links to colleagues and friends. This lateral movement amplifies the initial breach exponentially. I’ve spent the last six years reverse-engineering on-chain attacks. In 2020, I mapped the exploit path of a $30 million DeFi rug pull. In 2022, I modeled the Terra death spiral. But this is the first time I’ve seen a malware family specifically engineered to steal Telegram session tokens for targeted lateral propagation. That’s not a script kiddie operation. That’s a professional threat actor who understands the Web3 social graph. Let me dissect the technical architecture. The macOS variant is a .dmg file signed with an ad-hoc certificate—bypassing Gatekeeper if the user right-clicks and opens. The Windows variant is a .exe packed with UPX and uses a custom encryption routine to obscure its payload. Once executed, the malware drops a persistence agent: on macOS, a LaunchAgent; on Windows, a scheduled task. It then collects data via a series of modular plugins. Each plugin targets a specific data source: browser SQLite databases, keychain access, Telegram’s tdata folder. The exfiltration uses HTTPS POST requests to a command-and-control server that resolves to a Ukrainian IP range. SlowMist’s report identified three wallet clusters that received stolen funds—all still active. The rug is not pulled; it was never tied. Volume is noise; the wallet cluster is signal. The three clusters show a pattern: small test tranches (0.1–0.5 ETH) followed by larger sweeps if the seed phrase is confirmed valid. This indicates a human operator reviewing each victim’s haul before proceeding. The attacker’s operational security is decent—they use mixers and cross-chain bridges to obfuscate the final destination. But we have the initial transaction hashes. That’s enough to trace if exchanges cooperate. Now, the contrarian angle: what did the bulls get right? Some argue this is just another phishing variant. They point to the fact that hardware wallet users are largely unaffected—the malware cannot extract keys from Ledger or Trezor devices if the seed phrase is never typed on the compromised machine. That’s true. But the bulls miss the key point: the attackers invested in cross-platform development, AI narrative, and Telegram session theft. That signals a professional operation, not a script kiddie. It also validates that the Web3 hiring market is now mature enough to attract sophisticated cybercrime. That maturity is a double-edged sword—it means real jobs, but also real threats. Another counter-intuitive angle: this attack will accelerate the adoption of identity-based security tools. Decentralized identity (DID) and zero-knowledge proof-based interview platforms are already emerging. I’ve been consulting with two startups building sandboxed interview environments that run entirely in a browser-based VM. The attack’s silver lining is that it forces the industry to move beyond trust-me-bro security. Takeaway: This is not a one-off. Expect more AI-themed malware. The only defense is zero trust: never run unverified binaries, even from ‘recruiters.’ Use hardware wallets. Assume any interview request is malicious until proven otherwise. Gas fees are the price of truth; but here, the price of negligence is your entire portfolio. SlowMist has published the IOCs—update your detection rules. And if you’ve interviewed recently, rotate your Telegram session immediately. The trace leads backward, but forward, it leads to you.