The data suggests a new attack vector has emerged, one that bypasses traditional smart contract exploits and targets the human layer directly. Over the past week, SlowMist disclosed a phishing campaign where attackers impersonate recruiters from legitimate Web3 projects. They invite targets to install an AI-powered meeting tool called "Relay." The tool is malware. It steals browser credentials, encrypted wallet data, macOS Keychain contents, and Telegram sessions. This is not a theoretical vulnerability. It is a deployed, cross-platform information stealer. I have traced the code logic through the available sample analysis. The attack chain is clean, precise, and deeply cynical. It exploits the one thing most security audits ignore: trust in a job offer.
Context: The Web3 hiring ecosystem has grown rapidly. Projects compete for talent, and remote-first culture means interviews happen over video calls. Attackers weaponize this norm. They create fake LinkedIn profiles, scrape real project information, and approach developers, researchers, and community managers. The bait is an invitation to install "Relay," presented as an AI meeting scheduler or note-taking tool. Once installed, the payload executes silently. It targets both macOS and Windows. The malware hooks into the user's browser to extract saved passwords and cookie databases. It reads the files associated with MetaMask, Phantom, and other browser-based wallets. It dumps the macOS Keychain. It exfiltrates Telegram local session files, granting the attacker persistent access to the victim's Telegram account without needing the phone number or 2FA code.
This is not a zero-day exploit in a cryptographic library. It is a social engineering attack that exploits insecure defaults in how professionals handle job applications.
Core: Let me dissect the technical mechanics based on the indicators shared by SlowMist. The malware is likely packaged as a legitimate Electron application. The "Relay" installer is signed? We don't know yet. But the execution flow is standard for this class of stealer. On launch, it spawns a hidden process that enumerates all running processes. It looks for Chrome, Brave, Firefox, Edge, and browsers based on Chromium. It then reads the SQLite databases that store saved credentials. For each login, it decrypts the password using the browser's local encryption key. On macOS, this key is stored in the Keychain, which the malware also dumps by abusing the security command-line tool. It searches for known wallet extension directories under the user's Application Support folder. For MetaMask, it copies the vault.json file—the encrypted backup of the seed phrase. The decryption key is derived from the user's browser password, which by default is synced across devices if they use password sync. The malware also targets Phantom, Backpack, and other browser-based wallets.
The Telegram attack is particularly insidious. Telegram stores its local session cache in a directory called tdata. The malware copies this entire folder. With the session data, an attacker can log in as the victim on any device, bypassing SMS or 2FA. They can then monitor the victim's chats, impersonate them to contacts, and pivot to further attacks within Telegram groups of Web3 projects. This is a classic supply-chain style attack on trust relationships.
Based on my audit experience with wallet implementations, I see a pattern: the security model of browser-based wallets assumes the host machine is trusted. That assumption is fragile. Here, it is shattered. The attack does not exploit a cryptographic weakness—it exploits the fact that private keys are stored where the user can access them, which is exactly where malware can access them too. This is the same structural vulnerability I traced in 2017 when auditing ERC20 token contracts: the interface is simple, but the failure modes are paved by misuse.
I have also benchmarked similar malware during my MakerDAO stress tests. In 2020, I simulated liquidation cascades where price oracle latency created a gap for arbitrageurs. The gap here is not time, but trust. The user's willingness to run an unsigned binary because it came from a job offer. The code logic is clear: the attacker invested in cross-platform development, evasion techniques, and multi-vector data exfiltration. The return on investment is the ability to drain hot wallets and compromise Telegram accounts.
Tracing the silent logic where value meets code.
Contrarian: The standard defensive advice is "don't click on unknown links" or "verify the recruiter." This advice is insufficient. The attackers here are sophisticated. They use real project names, real employee names, and realistic AI-generated meeting tools. A developer with two years of experience in Solidity, desperate for a job in a bear market, will install the tool. The blind spot is that the Web3 hiring process lacks a verified identity layer. Recruiters on LinkedIn are not authenticated by the blockchain. There is no cryptographic proof that a hiring manager's message is genuine. The ecosystem has built zero-knowledge proofs for scaling, but zero trust for human interaction.
I do not trust the doc; I trust the trace. In this case, the trace shows that the attacker used a common technique: hosting the malware on a domain that mimics a legitimate meeting service. The domain might have been registered only days before the attack. Yet the typical user does not check domain registration date or SSL certificate issuance history. The real surprise is that this attack has not been more common. The reason it happens now is timing: AI hype makes people trust AI tools. The narrative of "AI meeting scheduler" is plausible. The attack is a direct consequence of narrative-driven technology adoption without parallel investment in security training.
The contrarian angle is that the solution is not better antivirus. It is changing how identity is verified in professional interactions. Web3 hiring should adopt a form of decentralized identity (DID) where recruiters sign their invitations with a public key. Candidates can verify the signature on-chain. Until then, the recommendation for any Web3 professional is to use a dedicated, ephemeral virtual machine for every job interview invitation. Treat every recruiter contact as a zero-trust request.
When abstraction fails, the NFTs bleed value. Here, it is not NFTs but trust that bleeds.
Takeaway: This attack vector will not be a one-off. It will evolve. I predict that within six months, we will see variants using deepfake audio or video to simulate the recruiter during a live screen-sharing session. The malware will then ask the victim to type their seed phrase into a fake terminal or connect a hardware wallet under the pretense of verifying identity. The only defense is to decouple your valuable keys from the machine used for communication. Use hardware wallets for all significant funds. Assume any unsolicited job approach is an attack until proven otherwise. If a recruiter asks you to install a proprietary meeting tool, demand a standard Zoom or Google Meet link instead. If they refuse, walk away.
Dissecting the corpse of a failed standard. The standard here is the trust model of online professional networking. It has failed. The code is clear: human trust is the weakest link. Trace it. Patch it. Do not rely on the next audit report to save you. The only security that matters is the one you enforce on your own machine.
ZK proofs are not magic; they are math. But this attack is not about math. It is about psychology. And psychology does not have a cryptographic fix—yet.