You just got a LinkedIn message. A Web3 startup wants to interview you. They send a link to an AI meeting tool called 'Relay'. Don't click. It's malware.

SlowMist dropped the analysis today. And the alpha isn't in the code — it's in the timeline of how this attack is engineered. This isn't your granddad's phishing. It's a custom, cross-platform infostealer designed specifically for web3 professionals. And it works.

The Hook: A Meeting Invite That Bleeds Keys

Here's the sequence. Attacker poses as a recruiter from a legit-sounding crypto project. Targets you on LinkedIn or Telegram. Sends a link to download 'Relay' — an AI-powered meeting scheduler. You install it, thinking it's just another Zoom clone. But behind the clean UI, there's a whole suite of theft.

SlowMist's team pulled the sample apart. It targets both macOS and Windows. It scrapes browser credentials, crypto wallet extensions, macOS Keychain, and — this is the kicker — Telegram session data. Every cached password. Every private key in your hot wallet. Every session token that lets you control your Telegram account.

I've been in this space since 2017. I audited BatCoin's consensus flaw in hours back then. This is different. This is precision targeting. The attacker knows exactly what we store on our machines. And they built a tool to grab it all in one shot.

Context: Why Now? The AI Gold Rush Created the Perfect Cover

We're mid-bull cycle, 2025. Every second post on my timeline is about 'AI-enhanced recruiting' and 'smart meeting schedulers'. The attack narrative feeds on that hype. When someone says 'try our new AI interview tool', we nod. We've been conditioned to expect innovation. The attacker doesn't need to break encryption — they just need you to click 'Run'.

This is the evolution of the social engineering we saw in DeFi Summer 2020. Back then, it was fake yield farming dashboards. Now it's fake job interviews. The vector changes, but the psychology stays the same. Trust + urgency = compromise.

The Core: What SlowMist Found — And What They Didn't Say

SlowMist's report confirms:

• Target platforms: macOS (DMG) and Windows (EXE). Cross-platform malware is rare; most attackers pick one OS. This crew has resources.
• Data harvested: Cookie and password databases from Chrome, Brave, Edge, Firefox. Crypto wallet files (MetaMask, Phantom, etc.) from extension directories. macOS Keychain — that's scary. Telegram tdata — session takeover.
• Exfiltration: The malware sends stolen data to a C2 server. SlowMist is still tracking the IPs.

But here's the insight you won't get from the press release: The Telegram session theft is the real gold mine. Why? Because once an attacker owns your Telegram session, they can impersonate you to your entire web3 network. They see your group chats. They send phishing messages to your colleagues, posing as you. One infected machine can become a vector for a whole team compromise.

In my experience organizing crypto meetups in Tallinn, I've seen how trust flows through Telegram groups. This attack weaponizes that trust. And most people don't even know Telegram stores session tokens locally.

Contrarian Angle: The Blind Spot — Decentralized Identity vs. Centralized Trust

Everyone's talking about using hardware wallets. But hardware wallets won't save you if your browser wallet keys are stolen from disk. The real problem is that web3 job hunting relies on a trust model that's completely broken.

Right now, when you apply for a crypto job, you hand over your resume, your LinkedIn profile, your Telegram handle. There's no on-chain verification. There's no DID that says 'I am a legitimate recruiter from XYZ protocol.' The entire process is still analog. And attackers exploit that gap.

SlowMist is calling for caution. But what we really need is a decentralized interview ecosystem. Imagine a platform where every job posting is signed by a multisig from the project's treasury. Every meeting link is generated smart contract that verifies both parties. Until then, we're all one DM away from losing our keys.

And here's the part that keeps me up at night: This attack is reproducible. The malware code can be forked. The social engineering script can be reused. I give it two weeks before copycats appear, targeting different roles — maybe DeFi auditors, maybe NFT artists. The template is now public.

Takeaway: What You Do Right Now

Don't install any 'AI meeting tool' from a recruiter you haven't verified through multiple channels. Call them on the phone. Ask them to send a calendar invite via a standard platform (Google Calendar, Calendly). If they push you to download something new, hang up.

If you already clicked? Disconnect from the internet immediately. Boot from a clean USB drive. Scan your machine with EDR tools. And rotate every password, every key, every session token. Assume compromise.

The alpha isn't in the next token launch. It's in the timeline of your browser history. One suspicious download — and your entire web3 identity is gone.

Stay safe out there.

This analysis is based on my direct experience auditing ICO whitepapers and hosting crypto meetups. I've watched social engineering evolve from Nigerian prince emails to this. The sophistication is rising. Our defenses need to, too.

Tags: Security, Phishing, SlowMist, Social Engineering, Web3 Jobs, Malware, AI Tool