The ledger doesn't lie, but the installer does.
On July 29, 2025, SlowMist published a forensic analysis of a new information-stealing malware targeting Web3 professionals. The attack vector is chillingly simple: an AI-powered interview tool named 'Relay' that doesn't exist. The payload, however, is very real.
Having spent years auditing smart contracts—including the infamous Paragon Coin integer overflow in 2017—I've learned that the most dangerous exploits often hide behind a veneer of legitimacy. This one is no exception. The attackers impersonated recruiters on platforms like LinkedIn, sending personalized invitations to install a meeting application. Victims who downloaded and ran the binary handed over their entire digital identity.
Context: The Weaponized Interview
The threat is neither a zero-day exploit nor a protocol vulnerability. It is a carefully orchestrated social engineering campaign that exploits the trust inherent in hiring conversations. The malware, analyzed in detail by SlowMist, targets both macOS and Windows. Once executed, it steals browser credentials, cryptocurrency wallet data, keychain entries, and even Telegram session tokens. This is not a scattergun attack; it is a surgical strike aimed at individuals who likely manage significant on-chain assets.
The choice of 'AI meeting tool' as a lure is no accident. In 2025, AI-powered recruitment is a booming narrative. Every week brings news of another startup using GPT-4 to screen candidates. The attackers piggybacked on this hype, knowing that a Web3 professional would be more willing to test a novel tool than a generic video conferencing link.
Core: Code That Collects Everything
Let's examine the technical chain. The installer—signed with a valid but likely stolen certificate—drops a payload that performs a broad sweep of sensitive directories. On macOS, it targets ~/Library/Keychains and ~/Library/Application Support. On Windows, it extracts data from Chrome, Firefox, and Brave browser vaults, as well as the %APPDATA% folders for MetaMask, Phantom, and other popular wallets.
Hype burns out. Code remains. The malware's ability to capture Telegram session tokens is particularly insidious. With a valid session, an attacker can impersonate the victim not only in direct messages but also in project group chats, potentially spreading further malicious links to colleagues or team mates. This creates a cascade of trust exploitation that can amplify the initial breach into a full-scale ecosystem compromise.
During the 2020 DeFi composability stress tests I ran on Aave and Compound, I observed how liquidity fragmentation could trigger hidden liquidation cascades. This attack follows a similar logic: a single point of failure—the victim's machine—can unravel an entire network of trusted relationships.
Contrarian: The Blind Spot Beyond the Wallet
Most security advice focuses on protecting private keys. That is necessary but not sufficient. The true blind spot here is the assumption that 'I don't store my seed phrase online' makes you safe. The malware steals session tokens and browser cookies. With access to a victim's Telegram session, an attacker can read all past communications, including sensitive discussions about upcoming token launches, private sale allocations, or unannounced partnership announcements.
Your private key is your only insurance policy—but if your Telegram account is compromised, the attacker can socially engineer your peers into sending funds to a malicious address under the guise of a 'confirmed investment opportunity.' The damage extends far beyond the initial wallet drain.
Moreover, this attack highlights a fundamental flaw in how Web3 professionals manage identity. Many use the same browser profile for work, trading, and personal communications. One install bypasses all segmentation.
Takeaway: The Signal for Next Week
Over the next 30 days, expect similar attacks to increase. The barrier to entry for this tactic is low: malware-as-a-service groups will likely repackage the code with different lures (e.g., 'DAO governance tool,' 'NFT minting bot'). The on-chain signal to watch is an uptick in unusual Telegram group behavior and the appearance of wallet connections from unknown IPs shortly after the victim's device is compromised.
My advice: before your next job interview, spin up a fresh virtual machine. Use a hardware wallet for signing. And remember—if a recruiter asks you to install a tool you haven't heard of, the ledger never lies. But the installer might.