The 'Relay' Trap: How Fake AI Interviews Are Draining Web3 Wallets

Chaos is opportunity. Compile the data.

Hook: Over the past 48 hours, my threat intelligence feeds lit up with a new signal: a malicious macOS/Windows binary masquerading as an AI meeting tool called 'Relay'. SlowMist's forensic breakdown reveals a surgical operation targeting Web3 professionals—not just random phishing, but a coordinated social engineering campaign that preys on the hiring frenzy. The malware steals browser credentials, keychain data, encrypted wallet files, and Telegram sessions. For a full-time trader like me, this isn't just a security alert; it's a liquidity event waiting to happen. Narrative broken. Shorting the dip? No—this time, the dip is in trust.

Context: The attack vector is deceptively simple. A fake recruiter reaches out via LinkedIn or Telegram, offering a high-paying role at a crypto startup. During the interview process, they ask the candidate to install 'Relay'—a custom AI-powered meeting assistant. Once installed, the binary executes a multi-stage payload that enumerates system files, decrypts browser-stored passwords, and exfiltrates wallet private keys via encrypted C2 channels. SlowMist confirmed that the malware is cross-platform (macOS dmg + Windows exe) and uses obfuscation to evade signature-based detection. The attack is live, with confirmed cases in the past week. The Web3 job market—already fragile after the 2022 bear—now faces a new class of operational risk.

Core: Let's dissect the technical mechanics. The malware leverages three core modules:

1. Credential Scraper: Targets Chrome/Firefox/Brave's SQLite databases for saved passwords. On macOS, it also dumps the system keychain using security dump-keychain.
2. Wallet Collector: Searches for common wallet directories (MetaMask, Phantom, Ledger Live, etc.) and copies their keystore files, prefs, and seed phrase-related files. It also captures hot wallet extensions by reading Local Extension Settings folders.
3. Session Hijacker: Grabs tdata folder from Telegram Desktop and .session files from Telegram macOS, enabling the attacker to impersonate the victim in ongoing conversations. This is the most dangerous part—it weaponizes the victim's network for secondary attacks.

Based on my own experience auditing Telegram trading bots, I've seen how easily a compromised session can lead to fund theft via fake 'admin' messages. The attacker doesn't need your private key if they can trick your colleagues into sending ETH to a 'new contract'.

The kill chain is elegant: fake recruiter → installation → data exfiltration → wallet drain → account takeover. SlowMist has published hashes and C2 domains. I've already blocked those IPs in my node's firewall. But that's reactive. The real question is: how many traders have already been infected?

Liquidity dries up. Watch the spreads.

Contrarian Angle: Most security analysts will focus on the malware itself—updating EDR signatures, advising users to avoid unknown apps. That's table stakes. The contrarian insight is that this attack reveals a structural vulnerability in the Web3 hiring market that cannot be patched by software alone. The attack capitalizes on the trust asymmetry between recruiters and candidates. Recruiters have no incentive to verify their own identity beyond a LinkedIn profile. Candidates, desperate for opportunities in a bear market, lower their guard. The result: an arbitrage opportunity for attackers.

But here's the twist: this event is actually a net positive for the ecosystem in the medium term. Why? Because it exposes the 'people layer' risk that most protocols ignore. Security audits of smart contracts are standard, but auditing the social engineering surface is not. This will accelerate adoption of decentralized identity (DID) and zero-knowledge credential verification for hiring. I'm already seeing demand for on-chain reputation systems like ENS-based identity proofs. The market for 'secure interview platforms' will emerge. Think of it as a new DeFi primitive: 'Proof of Trust'. Chaos is indeed opportunity.

Takeaway: Actionable levels? Not price levels—security levels. If you're a Web3 professional actively job hunting, do not install any 'AI meeting tool' unless you've independently verified the recruiter's identity via video call with a known domain. Use a dedicated VM or air-gapped device for interviews. Cold wallets stay cold. Telegram sessions should be cycled weekly. And if you've already received a suspicious invite, assume your keys are compromised. Move funds to a new wallet immediately. The spread between those who react now and those who wait is the difference between a full portfolio and a drained one. Trust no one. Verify the code.