A new malware strain, discovered by SlowMist in the past 48 hours, has already compromised an unknown number of Web3 professionals. The attack vector? A fake AI-powered meeting tool called “Relay,” distributed through LinkedIn job offers. The tool is not software. It is a cross-platform data thief targeting crypto wallet credentials, browser cookies, Keychain entries, and Telegram sessions. The code does not lie, only the LinkedIn profile does. This is not a random phishing campaign—it is a precision strike against the very people who build and maintain our industry. And the most damning fact is this: it worked because the victims trusted a narrative that we have all been trained to swallow—that AI tools are the future of work.
Context: The Honeypot of AI Recruitment
The cryptocurrency job market has exploded since the 2024 ETF approvals. Demand for smart contract engineers, security auditors, and DeFi strategists has outpaced supply. LinkedIn is flooded with recruiter messages. In 2025, AI meeting tools like Otter.ai, Fireflies, and automated interview schedulers have become standard. Attackers exploited this familiarity. They created fake company profiles, sent personalized invitations to install “Relay” for an AI-driven interview, and waited. The malware—custom-built for both macOS and Windows—captures credentials from browsers, exfiltrates encrypted wallet files, copies Telegram session tokens, and drains Keychain data. The target list is not random: they want the assets of people who hold private keys. Based on my audit experience, I have seen social engineering outpace smart contract bugs since 2020. This is the logical endpoint of an industry that prioritizes speed over verification.
But why now? The AI hype cycle has lowered everyone’s guard. We are conditioned to expect “innovation” in recruitment tools. The attackers banked on that conditioning. They understood that a Web3 professional is more likely to install an unknown binary if it is framed as a meeting tool with “AI capabilities” than if it were a simple PDF. The whitepaper of trust is being rewritten by criminals.
Core: A Technical Teardown of the Relay Malware
SlowMist released sample analysis within hours of the first report. The malware exhibits characteristics that go beyond script-kiddie phishing. Let me dissect the attack chain.
Initial Vector: A LinkedIn message from a fake recruiter at a legitimate-sounding crypto hedge fund. The message includes a link to a domain that mirrors the real company’s site, complete with SSL certificates. The victim is asked to download “Relay” from a subdomain. The installer is code-signed with a stolen or self-issued certificate. The signature is verified by the OS—trust is assumed.
Payload Delivery: On macOS, the package is a .dmg that contains a Mach-O binary. On Windows, it is an .msi or a .exe with UPX packing. The dropper checks for sandbox or analysis environments by detecting virtual machine artifacts (VMware, Parallels, VirtualBox). If found, it exits cleanly. This is a common anti-analysis technique, but the implementation here is sophisticated: it also checks for debugging breakpoints using ptrace on macOS and IsDebuggerPresent on Windows. If a debugger is attached, the malware does not execute its main logic.
Data Exfiltration: The malware enumerates all installed browsers (Chrome, Brave, Firefox, Safari, Edge) and extracts stored passwords, cookies, and autofill data. It targets the Keychain on macOS for API keys and application passwords. It specifically looks for files commonly used by crypto wallets: keystore, wallet.dat, secret.txt, and any file with .json from Electron-based wallets like MetaMask, Ledger Live, and Phantom. On Telegram desktop, it copies the session folder (tdata on Windows, ~/Library/Application Support/Telegram Desktop on macOS) to steal the session token. With that token, an attacker can impersonate the victim on any device without needing the password or 2FA. Telegram is often used for team and OTC deal communication in crypto. The risk extends beyond the individual.
Persistence: On macOS, the malware creates a LaunchAgent that runs at login. On Windows, it adds a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The binary renames itself to a legitimate-sounding name like com.apple.helpd or svchost.exe. Even after deletion, the LaunchAgent may reload the malware if the plist is not removed. I have seen similar persistence mechanisms in audits of compromised DeFi treasuries—they are easy to implement but hard to detect without endpoint monitoring.
Command and Control (C2): The malware uses HTTPS POST requests to a series of hardcoded IPs on port 443. The data is encrypted with a hardcoded RSA key before exfiltration. This makes network monitoring difficult unless the security team has SSL decryption. The C2 servers are likely VPS instances paid for with cryptocurrency, making attribution nearly impossible. SlowMist’s report lists specific hashes and C2 domains; I will not reproduce them here to avoid giving attackers feedback, but the community must share IOCs immediately.
What is missing from the analysis is the exact mechanism for keylogging or screen capture. The malware does not appear to include a keylogger, but it does capture clipboard data on a timed interval. This means if a victim copies a private key or a seed phrase, the clipboard is exfiltrated. The attackers are betting that users will copy-paste sensitive data during an “interview” setup. It is a devastatingly simple assumption, and it is likely correct.
Vulnerability Exploitation: The malware does not exploit any operating system zero-days. It does not need to. It uses the legitimate APIs of the OS to access user data. The vulnerability is not in the code; it is in the human trust model. The code does not lie, only the whitepaper does. Here, the whitepaper is the fake job description.
Contrarian: What the Attackers Got Right (and Why the Bulls Are Wrong to Downplay This)
The common reaction to such news is: “This is just another phishing campaign. Educate users and move on.” That is dangerously simplistic. The contrarian angle is that the attackers understood something most security teams don’t: Web3 professionals have been conditioned to trust innovation over verification. The industry has spent years praising “move fast and break things” culture, hiring based on portfolio size rather than security hygiene, and promoting tools that prioritize UX over isolation. The attackers exploited this cultural flaw more precisely than any technical flaw.
Consider the timing. The AI narrative is at peak hype. Every Web3 job posting now mentions “AI integration,” “machine learning models,” or “automated analysis.” An AI meeting tool is not a red flag—it is a green flag. The attackers rode the AI wave. They also chose the right platform: LinkedIn, where trust is assumed because profiles are vetted (but vetted for what? A fake profile with a stock photo and a stolen company name takes minutes to create). The bulls who say “just don’t click unknown links” miss the point. The link was not unknown; it was presented as an essential tool for a job interview at a legitimate-sounding company. The verification protocols of LinkedIn, Zoom, and even the company’s own website were bypassed because the human-to-human interaction felt real.
Furthermore, the malware’s cross-platform capability and anti-analysis measures show that the attackers are not amateurs. They have likely run similar campaigns before, perhaps targeting fintech or defense contractors. The lack of a full keylogger suggests a focus on stealth—data exfiltration without raising alarms. The C2 infrastructure uses encryption and obfuscation. This is not a script kiddie operation. It is a professional cybercrime group, possibly with ties to a larger ransomware ecosystem. The market is wrong to treat this as a one-off. It is a template for the next generation of crypto theft.
On the positive side, the bulls are correct that this attack does not break any cryptographic primitives. The blockchain itself is secure. No smart contract was exploited. The attack is on the user’s local environment. That means the industry can mitigate it with better user education and hardware isolation. The contrarian insight is that education alone is insufficient. We need structural changes: mandatory sandboxed interview environments, endpoints that refuse to run unsigned code even if verified by the OS, and identity verification for recruiters using blockchain-based attestations. The attackers got the social dynamics right; we must change the dynamics.
Takeaway: Trust is a Variable, Verification is a Constant
The Relay malware campaign is a wake-up call for every Web3 professional. It proves that the weakest link is not the smart contract, not the consensus mechanism, not the oracle. It is the trust in human interaction. The ledger remembers what the founders forget—but only if the users survive the interview.
I have one question for every founder, HR lead, and security auditor reading this: Will you continue to rely on an informal LinkedIn connection and a .dmg file to vet the next person who holds your team’s private keys? Or will you demand a verification standard that matches the value at risk?
Precision is the only form of respect. Right now, our industry is showing disrespect to its own security. The code does not lie; the attacker’s LinkedIn profile does. It is time to audit the social layer with the same rigor we apply to smart contracts. In the bear market, only the audited survive—and in this context, “audited” means verified identities, isolated execution environments, and a culture that treats every download as a exploit until proven otherwise.
I read the implementation, not the intent. The implementation of this attack is flawless social engineering. The intent is your private keys. Do not download “Relay.” Do not trust a job offer without a verified digital signature. And for the love of Satoshi, use a hardware wallet for everything. Trust is a variable; verification is a constant.