The Code Doesn't Lie. The Installer Does.

The code doesn't lie. But the installer does. In July 2025, a new breed of malware bypassed every smart contract audit. It didn't exploit a DeFi protocol. It exploited a job interview.

Attackers impersonated recruiters from legitimate Web3 firms. They lured professionals into installing a fake AI meeting tool called "Relay." The payload was a cross-platform info-stealer — targeting both macOS and Windows. SlowMist analyzed the samples. The findings are clinical. The malware harvests browser credentials, keychain data, Telegram session tokens, and cryptocurrency wallet files. It exfiltrates everything. Then it vanishes.

This is not a protocol vulnerability. It is a human trust exploit. And it is perfectly targeted.

Context: The Attack Chain

The attack begins with reconnaissance. The threat actor creates fake LinkedIn profiles. They pose as talent acquisition leads at prominent Web3 companies. The target — a DeFi auditor, a smart contract developer, a security researcher — receives an invitation to a screening call. The recruiter sends a link. "Download this AI-powered meeting assistant before the call." The file is signed, packed, and undetectable by standard antivirus.

Upon execution, the malware checks the environment. It looks for endpoints. It extracts saved passwords from browsers. It dumps private keys from wallet apps like Phantom, MetaMask, or Exodus. It copies the entire contents of macOS keychain. It steals Telegram local storage — granting access to all group chats and direct messages. The attacker can now impersonate the victim, bypassing two-factor authentication if session tokens are present.

SlowMist's report confirms the threat actors used a legitimate certificate for signing the macOS version. This bypasses Gatekeeper. The Windows variant uses a custom packer to evade Defender. The code is modular. It communicates with a C2 server via HTTPS. The infrastructure is likely disposable — domain registered days before the campaign, hosted on a bulletproof provider.

Core: Technical Autopsy

Based on my audit experience, this is not a sophisticated exploit in the traditional sense. There is no zero-day. No buffer overflow. No reentrancy attack. This is social engineering weaponized by custom malware. The innovation is in the narrative, not the code.

But the code itself deserves scrutiny. The malware uses three distinct modules:

1. Harvester – Scrapes browser profiles for credentials, cookies, and autofill data. It supports Chrome, Firefox, Brave, and Edge. It also targets the ~/.config/solana/id.json file — the default Solana wallet keypair.

1. Keychain Dumper – On macOS, it leverages the security dump-keychain command with a local privilege escalation technique. This is not novel, but it works because most developers leave their keys unlocked during work hours.

1. Session Hijacker – For Telegram, it copies the tdata folder. With that, the attacker can fully control the victim's Telegram account without triggering a login alert. This enables follow-up phishing on the victim's network.

The malware does not persist. It runs once, exfiltrates data, then deletes itself. This reduces forensic footprint. It also suggests the attackers are disciplined — they understand incident response workflows.

Contrarian: The Real Vulnerability Is Not the Code

The industry obsesses over smart contract audits. We review Solidity, Rust, and Vyper. We model game theory. We simulate attacks. But none of that matters if an auditor installs a .dmg from a fake recruiter.

Resilience isn't audited in the winter. It is tested in the field. The bottleneck isn't the infrastructure. It is the trust we place in a LinkedIn message.

This attack exposes a fundamental gap: security culture. No amount of code analysis prevents a user from clicking “Allow” on a malicious prompt. The assumption that Web3 professionals are immune to social engineering is dangerous. They are the prime target because they control the keys.

Smart contract audits are necessary but insufficient. The next wave of exploits will not target DeFi protocols. They will target the humans who audit them. The attack surface is shifting from logic to psychology.

Takeaway: What Comes Next

The code doesn't lie. But the installer? The installer is just the delivery mechanism. The real threat is the narrative — AI tools as Trojan horses. Expect deepfake video interviews next. Expect spear-phishing using stolen Telegram identities to compromise entire project teams.

The fix is not technical. It is procedural. Isolate your work environment. Never install proprietary software for a job interview. Use a disposable virtual machine. Store private keys on a hardware wallet — and never connect it during an interview.

The market corrects. The code remains. But if you install the payload, the code doesn't matter.

SlowMist's analysis provides the indicators. But the lesson is older than blockchain: trust, then verify. In Web3, verify first. Always.