A new malware sample crossed my desk yesterday. SlowMist flagged it—a custom infostealer disguised as "Relay," an AI-powered meeting app, targeting Web3 professionals via fake job interviews. The attack chain is textbook social engineering, but the payload is anything but textbook: cross-platform, credential-harvesting, wallet-draining code. This isn't a phishing email. It's a targeted operation against the people building the narrative.
Tracing the fault lines where code meets capital.
Let's strip the hype. The attackers posed as recruiters on LinkedIn, sending candidates a link to download "Relay" for an automated interview. The app installs a trojan that exfiltrates browser credentials, macOS keychain data, Telegram session tokens, and—most critically—crypto wallet files. Two binaries: one for macOS, one for Windows. The Windows variant alone can scrape over 20 wallet extensions, from MetaMask to Phantom. The macOS variant bypasses Gatekeeper by using a developer ID certificate that was likely stolen or fraudulently obtained.
We don't chase narratives; we intercept them.
This isn't a theoretical vulnerability. It's a live operation, and the timeline suggests it's been active for at least two weeks. SlowMist's report includes IOCs—hashes, domains, C2 addresses—but the real story is the operational security failure at the protocol layer of trust. The entire Web3 hiring ecosystem runs on LinkedIn, Telegram, and unsanctioned video tools. There is no cryptographic verification of an interviewer's identity. No on-chain proof of employment. The attack exploits this gap: code meets capital, but the code is malicious.
During the 2018 Loom Network audit, I found an integer overflow in their staking contract. The team patched it before mainnet. That taught me a hard lesson: narrative without technical integrity is a liability. Fast forward seven years, and the same lesson applies to hiring. If you cannot verify the identity of the person on the other side of the screen, you are trusting a social graph that was designed for Web2, secured by screen names, not signatures.
Core analysis: The malware uses a multi-stage loader. The initial download is a small .dmg (macOS) or .exe (Windows) that fetches the second-stage payload from a domain registered only three weeks ago. The payload injects into system processes to evade detection by common EDR solutions. For macOS, it uses NSTask to launch a shell script that dumps the keychain using security dump-keychain. For Windows, it leverages CredEnumerateW to steal stored credentials from Chrome, Firefox, and Opera. The Telegram session theft is particularly dangerous—session tokens allow an attacker to impersonate the victim in real time, sending messages to colleagues or project groups with authority.
Quantified impact: If a victim had $50,000 in a hot wallet and used that wallet on a browser with the extension installed, the attacker extracted the private key within 60 seconds of execution. No additional phishing required. The data exfiltration is encrypted over HTTPS to a C2 server hosted on a bulletproof provider. Based on the reverse engineering, the malware includes a module that checks for hardware wallets—if detected, it logs the device VID/PID and attempts to trick the user into signing a transaction. This is not a script kiddie operation. This is a professional team with at least two developers (one per platform) and a social engineer who understands the Web3 community's reliance on Telegram and LinkedIn.
Contrarian angle: The market narrative will focus on "avoid suspicious interview links," but the real blind spot is the trust asymmetry in Web3 hiring. We demand zero-knowledge proofs for DeFi transactions but accept a LinkedIn profile as proof of employment. The attack vector isn't the malware; it's the social graph. Even if you never install "Relay," your Telegram contacts are at risk because a colleague's stolen session can be used to message you. The second-order effect is a liquidity crisis of talent: startups will hesitate to hire remotely, slowing down protocol development. And the security sector? It will benefit, but only if it moves from reactive audits to proactive identity tools.
Shorting the hype to fund the truth.
I see a parallel to the 2022 Terra collapse. Then, the flaw was in the algorithmic stablecoin's leverage. Now, it's in the algorithmic trust of remote work. Both cases involve a failure to verify security assumptions. In 2022, I helped my university's investment club short Anchor Protocol using synthetic assets. We preserved 80% of our portfolio. The lesson: don't trust the narrative until you've audited the mechanism.
Takeaway: The next evolution of Web3 hiring will require on-chain identity verification—soulbound tokens for employment, verified by organizational wallets. Until then, every interview invitation should be treated as a potential exploit. Survival is the first metric; profit is the second. Code breaks. Stories don't. But when the code is malicious, the story becomes a liability.
Build empires on the volatility of belief, but verify the foundation first.