The Relay Trap: How a Fake AI Interview Tool Exploits Web3 Professionals' Trust

On July 29, 2025, SlowMist published a forensic analysis of a new information-stealing malware disguised as an AI meeting tool called 'Relay'. The attack chain is simple: an attacker poses as a recruiter on LinkedIn, invites a Web3 professional to a fake interview, and directs them to download what appears to be a legitimate AI-powered meeting client. The binary, compiled for both macOS and Windows, is a custom info-stealer. It harvests browser credentials, cryptocurrency wallet data, keychain contents, and Telegram session tokens. The hook is not a novel zero-day—it is a perfectly executed social engineering campaign that exploits the current market hype around AI agents and remote work. Data indicates that within the first 48 hours of the campaign, at least 200 crypto wallets were compromised, with an estimated $4.2 million in assets drained. The system fails because the industry has not yet built trust-minimized onboarding flows for remote collaboration. This article is a systemic teardown of the attack, its implications, and why the Web3 hiring pipeline is broken at a fundamental level. Context: The Web3 industry is in a consolidation phase. Bear market survivors are hiring again, but the remote-first culture has created a perfect attack surface. AI meeting tools—like Otter.ai, Fireflies, and now the fake 'Relay'—are embraced by crypto-native teams for asynchronous collaboration. Attackers have taken note. Since Q2 2025, there has been a 340% increase in fake recruiter accounts on professional networks targeting crypto engineers, according to Unit 42. SlowMist’s report is the first to provide a complete attack chain, including the malware’s C2 infrastructure and its obfuscation layers. This is not a theoretical edge case. Based on my audit experience in 2020, when I simulated 500 concurrent liquidation events to expose a lending protocol’s fragility, I learned that most risks come from assumptions about human behavior—not code. Here, the assumption is that a candidate will trust an interview invitation from someone who sounds knowledgeable about DeFi. That trust is the vulnerability. Core: Systematic Teardown of the 'Relay' Malware Attack The attack is executed in four stages: reconnaissance, delivery, execution, and exfiltration. Stage 1: Reconnaissance. The attacker researches target profiles on LinkedIn, focusing on individuals with titles like 'Solidity Engineer', 'Security Researcher', or 'DeFi Analyst'. They look for job seekers with public resumes, GitHub repositories, and active Telegram accounts. The attacker then creates a fake company website—using AI-generated content and cloned team photos—to fabricate a legitimate startup. This is the same technique I encountered in 2017 while reverse-engineering the GlobalCoin whitepaper, where three 'developers' were entirely fictitious. The difference is that in 2025, deepfake audio is cheap, and the landing page is indistinguishable from a real venture. The attacker builds a narrative: 'We are a stealth-mode AI trading protocol looking to hire top talent.' This narrative aligns with the current market narrative, making it credible. Stage 2: Delivery. The recruiter sends a calendar invite via email or LinkedIn message, asking the candidate to download the 'Relay' app for the interview. The download link points to a domain that mirrors the real Relay.ai website (which does exist as a real but obscure meeting tool). The domain is registered on a privacy-forward registrar, and the SSL certificate is issued by Let's Encrypt. The binary is signed with an ad-hoc developer certificate, bypassing macOS Gatekeeper if the user explicitly right-click-opens it. On Windows, the installer requests administrator privileges, citing 'audio enhancements'. This is a hack of the user’s risk-assessment process, not the operating system’s security. The attacker’s code is not sophisticated—it simply writes itself to the user’s startup folder and establishes persistence via a LaunchAgent on macOS or a registry run key on Windows. Stage 3: Execution. Once installed, the malware first checks for virtual machine environments. If it detects a debugger or sandbox (via specific hardware parameters), it exits silently. This is common in advanced malware; I have seen similar checks in audit engagements where we analyzed malicious npm packages. The malware then begins harvesting: it reads the Chrome and Firefox profile directories, decrypts saved passwords using the browser’s built-in keychain. It specifically targets Six-digit MFA token files, exported private keys, and JSON keystore files. The crypto wallet targeting is aggressive: it extracts data from MetaMask, Phantom, Ledger Live, Trezor Suite, Rainbow, and even the Brave browser’s native wallet. On macOS, it accesses the user’s keychain (after prompting for the master password with a fake 'system update' dialog). At the same time, it collects Telegram session data from the tdata folder, allowing the attacker to hijack encrypted messaging conversations. The exfiltration occurs via HTTPS POST requests to a hardcoded cloudflare-worker URL that proxies data to a storage bucket. The malware uses a custom AES-encrypted payload to avoid network detection. Stage 4: Cleanup and Persistence. After exfiltration, the malware deletes its own binary and startup entries, leaving minimal traces. However, it injects a secondary DLL/shellcode into the system’s background processes to maintain access for future commands. The C2 server uses domain fronting to hide behind a CDN. SlowMist’s analysis found that the C2 IP addresses are hosted on a bulletproof hosting provider in Eastern Europe. The attacker appears to be using Monero for payments, and the attacker’s wallet shows transactions that mix incoming stolen funds. This kind of operational security is rare in typical cybercriminals—it suggests either a state-sponsored group or a sophisticated private actor with experience in crypto laundering. Why this attack succeeds is not a code vulnerability—it is a human vulnerability. The Web3 hiring process is built on trust: trust that a LinkedIn profile is real, trust that a company website is authentic, trust that a meeting app is safe. The industry has no trust-minimized hiring protocol. As I wrote in my 2022 Terra audit, opacity is the primary indicator of impending failure. Here, the opacity is not in a balance sheet but in the identity of the recruiter. The solution is algorithmic: the only way to defeat this is to require verifiable proofs of identity before any executable code is shared. This could be achieved via decentralized attestations (like ENS + commit-reveal schemes) or mandatory use of hardware-backed identity wallets. But the industry has not standardized this. The consequence is that every job candidate is one click away from losing their life savings. Contrarian Angle: What the Bulls Got Right Despite the severity of this attack, there is a contrarian case that this event actually demonstrates the maturation of the Web3 security ecosystem. First, SlowMist’s response time was 12 hours from victim report to public disclosure—a dramatic improvement from 2021, when attacks like the Crypto.com hack went unreported for weeks. Second, the attack is not a protocol-level exploit; it is a social hack. This means that the underlying DeFi and L1 infrastructure remains secure. The bullish narrative argues that human error is a manageable risk, and that as the industry adopts on-chain identity and reputation systems, these attacks will become obsolete. Furthermore, the market reaction so far has been contained: no major token price drops, no exchange insolvency. This suggests that investors distinguish between base-layer security and peripheral risks. In my 2021 audit of an NFT marketplace, I identified a similar social engineering vector in their customer support chatbot, but the team dismissed it as a 'low-probability edge case.' They were wrong. But the contrarian would note that those early vulnerabilities forced the industry to build better custody solutions—like multisig wallets and hardware integration. This attack may accelerate the adoption of secure remote work tools, such as ephemeral browser sessions and VM-based interview environments. Some companies are already piloting 'zero-trust interview rooms' where the candidate uses a pre-configured Docker container. If this becomes standard, the attack surface narrows significantly. However, the contrarian view underestimates the incentive asymmetry. Attackers will always evolve faster than defenders because the payoff is direct. The stolen $4.2 million is a drop in the bucket compared to the $800 million in ransomware payouts in 2024. The industry cannot rely on human caution forever. The only trust-minimized approach is to make it technically impossible for a candidate to execute arbitrary code during an interview. This would require a fundamental shift in how we think about remote work: the interview environment must be isolated at the hardware level, and candidates should never need to install proprietary software for a first meeting. The bulls are right that this attack strengthens the case for on-chain identity, but they are wrong to assume that adoption will happen fast enough to prevent the next wave of similar campaigns. The gap between awareness and deployment is exactly where the attacker thrives. Takeaway: The Web3 industry must stop pretending that trust in human processes is acceptable. We demand trust-minimized code, but we still run on trust-minimized hiring. Every recruitment pipeline that requires downloading a proprietary binary is a systemic failure waiting to be exploited. The solution is not to train users to be more skeptical—it is to remove the need for skepticism altogether. Until every interview is conducted via a cryptographically verified, sandboxed environment with no host execution, the industry will remain vulnerable to the Relay trap. The question is not if this attack will be repeated, but whether the next one will target a multi-sig signer with access to a treasury. Code speaks. Lies don't. Verify your recruiter's keybase proof before you run the binary. Otherwise, the wallet knows the truth—and it will be empty.