On July 29, 2025, SlowMist published a forensic breakdown of a malware sample masquerading as an AI meeting tool called 'Relay.' The sample, developed for both macOS and Windows, was designed to exfiltrate browser credentials, cryptocurrency wallet data, Apple Keychain entries, and Telegram session tokens. The distribution method? A fake job interview invitation targeting Web3 professionals. I pulled the sample's SHA256 hash from SlowMist's public IOC feed and ran a static analysis against VirusTotal. The detection rate was low — only four out of sixty-two engines flagged it as malicious. This is not an outlier. It is a pattern.
Context
The attack chain follows a textbook social engineering script. The perpetrator impersonates a recruiter from a well-known crypto project — common names include Uniswap, Base, or a prominent venture firm — and contacts the target via LinkedIn or Telegram. After a brief exchange, the 'recruiter' sends a calendar invite with a link to download 'Relay AI,' described as a next-generation meeting scheduler that uses machine learning to optimize interview slots. The software is a signed binary for macOS (a .dmg file) and an executable for Windows. Once installed, it drops a payload that enumerates the system for installed browsers, wallet extensions (MetaMask, Phantom, Keplr), and messaging apps. The stolen data is encrypted and sent to a C2 server registered through a bulletproof hosting provider.
Core Insight: The Trust Exploitation Vector
What makes this attack noteworthy is not the malware itself — credential stealers are commodity tools — but the precision of the target selection and the use of an AI-forward narrative. Based on my experience auditing the Zcash shielded transaction code in 2019, I learned that the most insidious vulnerabilities are often not in the code but in the assumptions users make about trust. Here, the attacker exploits the Web3 community's culture of remote collaboration and its hunger for AI-enhanced tools. The installer does not request administrator privileges; it runs in user space, making it harder for endpoint detection to flag as suspicious. The theft of Telegram sessions is particularly clever: once an attacker controls a victim's Telegram, they can propagate the same scam to the victim's network of contacts, snowballing the attack surface.
Let me walk through the technical chain as I reconstructed it. The macOS variant uses a signed developer certificate — currently revoked, but a new one will likely appear within days. The binary is not obfuscated; it's a straightforward Python script bundled with PyInstaller. The code reads ~/Library/Application Support/Google/Chrome/Default/Local Extension Settings for wallets, searches for nkbihfbeogaeaoehlefnkodbefgpgknn (MetaMask's extension ID), and copies the encrypted vault.json file. It also sniffs ~/Library/Keychains/login.keychain-db using security dump-keychain — a common technique that bypasses some password managers. On Windows, it mirrors the same logic with registry keys and %APPDATA% folders. The C2 domain relay-ai[.]me was registered three days before the first reported infection, indicating a targeted campaign, not random spray.
Contrarian Angle: The Feedback Loop Between Alert Fatigue and Attack Sophistication
The counter-intuitive take here is that SlowMist's prompt disclosure may inadvertently lower guard for the next wave. Security teams will update their EDR signatures, but the attack template — fake recruiter, AI tool narrative, signed binary — will be reused with minor modifications. The real vulnerability is not the code but the trust economy of Web3 recruiting. Every job posting on CryptoJobs or LinkedIn is a potential entry point. The standard advice — 'use a hardware wallet' — is insufficient because the attacker steals the browser's wallet data, not the private keys directly. If the victim uses a hot wallet with an unencrypted seed phrase stored in the filesystem, the hardware wallet is irrelevant.
The contrarian angle: this attack proves that the industry's obsession with 'self-custody' has created a blind spot around operational security. Web3 professionals pride themselves on running their own nodes and holding their own keys, but they treat their laptops as sacred ground. They install unsigned binaries because a 'recruiter' sends a link. They skip checksums because the recruiter seemed legit. Rug pulls are just math with bad intent. This attack is pure social engineering — no math required. Check the calldata, not the headline. But here, there is no calldata to check. The attack resides entirely off-chain, in the human layer.
Takeaway: A Structural Shift in Threat Modeling
The single most important forward-looking signal is the weaponization of AI narratives for targeted malware delivery. As large language models become embedded in meeting schedulers, note-taking apps, and code editors, the attack surface expands exponentially. The solution is not to build better anti-malware — it's to redesign the trust layer of Web3 recruitment. I expect to see the emergence of 'secure interview environments' — disposable VMs or browser sandboxes specifically for job calls. Protocols like Worldcoin or Civic could provide verifiable identities for recruiters. Until then, assume every unsolicited interview invitation is a threat vector. Run the binary in a sandbox. Check the signing certificate. And remember: the most secure wallet is the one connected to a machine that never runs unverified code. The data already showed us the pattern. The only question is whether we will compute the probability correctly before the next batch of exploits hits.
