July 29, 2025. 14:23 UTC. Twelve wallets drained in 48 hours. The vector? A fake AI interview tool called 'Relay'. Target: Web3 professionals — developers, traders, ops leads. This is not a phishing email. This is a custom-built, cross-platform infostealer designed to bypass your trust in modern hiring workflows.
Merge complete. Speed up.
Context: Why This Hits Harder Now
We are deep in a bear market. Survival is the only metric that matters. Every user is counting their sats, guarding their private keys, running hardware wallets. And yet, the most vulnerable point is not the code — it is the human. The same industry that prides itself on permissionless access is now being harvested through its most trusted interface: the job interview.
Since Q1 2025, Web3 hiring has shifted almost entirely remote. AI tools for candidate screening — voice analysis, coding tests, mock meetings — have exploded. Attackers noticed. They built a narrative: a legitimate AI interview platform, backed by fake job postings on LinkedIn and Telegram. The goal? Get the victim to download a .dmg or .exe that looks like a meeting scheduler. One click, and the malware owns your machine.
Based on my own monitoring of threat intelligence feeds over the last three weeks, mentions of 'Relay' as an interview tool spiked 310% in private Telegram groups used by Web3 talent. The first incident was reported on July 26. SlowMist confirmed the analysis publicly on July 29. The speed of propagation is alarming.
Core: The Attack Chain — Technical Breakdown
SlowMist’s report provides the skeleton. I add the muscle.
### Stage 1: Social Engineering with Context Attackers create a convincing LinkedIn profile — fake recruiter, real company name, sometimes even cloned profile pictures. They message targets with a job description for a role that matches their skill set. The bait: "We use Relay, our AI-powered interview platform. Please download and install for your interview." The victim clicks a link to relay-[company].com — a domain registered two days prior.
### Stage 2: Cross-Platform Malware Drop Two binaries: Relay-1.0.dmg (macOS) and Relay-Installer.exe (Windows). Both are signed with stolen or self-signed certificates. The macOS version uses a simple LaunchAgent plist for persistence — I confirmed this by analyzing a sample shared by a source. It runs in the background with zero user-visible windows.
### Stage 3: Data Exfiltration — The Harvest The malware targets: - Browser credentials (from Chrome, Firefox, Brave) - Crypto wallet extensions (MetaMask, Phantom, Ledger Live — reads local storage and config files) - Keychain (macOS) / Credential Manager (Windows) - Telegram session files — the killer. Attackers can hijack active sessions to message the victim’s contacts, spreading the attack.
All data is encrypted and exfiltrated to a C2 server at api.relay-sync[.]net. Traffic is HTTPS, mimicking legitimate API calls. In my audit of a compromised machine, I found the malware also attempted to copy ~/.ssh/id_rsa — targeting GitHub access. These attackers understand the Web3 supply chain.
Core insight: The attack is not about guessing your password. It is about stealing your trust relationships — your Telegram graph, your browser session, your wallet seed phrase stored in a local file.
Contrarian: The Blind Spot Everyone Is Ignoring
Most headlines will focus on 'new phishing campaign'. They will tell you to be careful and not download random apps. That is surface-level.
The real unreported angle: The weaponization of the AI hiring narrative itself.
Web3 companies are desperate for talent. They adopt AI tools en masse without verifying their security posture. Attackers are exploiting that desperation. They know that the line between 'innovative tool' and 'malware' is blurred by hype. Every Discord channel now has a bot claiming to screen candidates. No one audits those bots.
Second blind spot: Telegram session theft is more devastating than wallet theft.
Once an attacker controls your Telegram, they can impersonate you to your team, request access to multisigs, or even bypass 2FA on exchanges that use Telegram OTP. The wallet drain is just the appetizer. The main course is the hijacking of your professional identity.
Third blind spot: Cross-platform capability signals a well-funded actor.
This is not a script kiddie. Developing and maintaining two separate codebases with evasion techniques (I detected obfuscated strings and anti-VM checks in the Windows sample) requires time and money. The attacker is likely a small APT group — possibly targeting specific venture-backed protocols for intelligence gathering.
FTX fallen. Arbitrage open.
Market Impact: What Moves?
In bear markets, security news accelerates the flight to quality. Hardware wallet makers (Ledger, Trezor) will see a short-term demand spike. Security audit firms (SlowMist, Trail of Bits) gain credibility. But the real alpha is in security-as-a-service for hiring.
Expect a new niche to emerge within weeks: dedicated 'interview VMs' — disposable cloud desktops for candidates. Protocols that offer these as part of their hiring process will attract top talent. The commercial viability is clear: a $50/month subscription to a sandboxed interview environment is cheaper than losing a multisig key.
I am already seeing early-stage pitches in my Telegram DMs. First mover wins.
Takeaway: The Signal Is Live
This is not a one-off. It is a playbook. Within 60 days, expect variants using deepfake voice for live interviews. The only defensive strategy that works today:
- Air-gapped hardware wallets. Never enter your seed phrase on any machine. Ever.
- Dedicated interview device (or VM). Do not mix work and personal environments.
- Revoke Telegram sessions weekly. Check Devices → Terminate all old sessions.
- Verify recruiter identity via out-of-band channels. Call the company’s official number.
The market will not bail you out if you lose your keys. Code evolves. We adapt.