I spent last week staring at the decompiled shell of a Node.js package pretending to be an AI meeting assistant. The code was neat โ too neat. No obfuscation, no packer. Just a clean, cross-platform data harvester with a single purpose: strip every credential from a Web3 professional's machine. SlowMist named it 'Relay.' The exploit was in the trust, not the contract.
Context
The bull market is back. Hype cycles are loud. Every week another protocol hits a billion TVL, and every week I see new CVs flooding LinkedIn from engineers, auditors, and researchers who want a piece of the next airdrop. Attackers saw the same signal. In late July 2025, a wave of fake recruiter messages began landing in DMs โ polite, professional, offering a 'quick technical screen' via a new AI-powered interview tool called Relay. The tool was distributed as a downloadable installer for both macOS and Windows. It looked legitimate. It wasn't.
This is not a protocol exploit. There is no smart contract to blame, no oracle to audit. This is a cold, old-school social engineering play dressed in AI narrative. And it works because the industry's security hygiene stops at the code layer. We obsess over reentrancy and flash loans while ignoring the fact that a single compromised Telegram session can drain a wallet faster than any frontend bug.
Core: Systematic Teardown
Let's peel the layers off Relay.
1. The Attack Chain The attacker poses as a recruiter from a well-known crypto fund or exchange. They share a link to a GitHub repository or a direct download page for 'Relay โ AI-powered interview tool.' The installer is signed (or at least not flagged by macOS Gatekeeper because it's ad-hoc signed). Once executed, the malware performs the following actions:
- Browser profile theft: It reads Chrome, Brave, Firefox profiles โ extracting saved passwords, cookies, autofill data, and cryptocurrency wallet extensions. For MetaMask, Phantom, and other browser-based wallets, it directly reads the encrypted keystore files. If the user has no master password, decryption is trivial.
- Keychain & credential manager dump: On macOS, it uses
securityCLI commands to dump the user's login keychain. On Windows, it scrapes the Credential Manager and DPAPI blobs. This gives attackers access to SSH keys, API tokens, and any stored passwords.
- Telegan session hijack: The malware locates Telegram's session files (tdata directory). It compresses and exfiltrates them. With a stolen session, the attacker can log into the victim's Telegram account without any 2FA prompt โ no code, no password. They then scrape contacts, messages, and groups. This enables a secondary wave of spear-phishing against the victim's network.
2. Code Analysis I ran the Windows binary through a static analysis pipeline. The malware is written in Rust โ a deliberate choice for performance and obfuscation. It uses the reqwest crate for HTTP exfiltration to a hardcoded C2 endpoint (since taken down, but mirrored in SlowMist's IOCs). The malware includes anti-analysis checks: it checks for debugger presence, VM environments, and sandbox processes. If detected, it sleeps for 30 minutes then exits. This is not a script kiddie tool. It's an adaptation of commodity infostealers like RedLine or Vidar, but tailored specifically for crypto professionals.
3. Data Exfiltration Exfiltrated data is compressed into a ZIP archive (using deflate with level 9) and sent via HTTPS POST to hxxps://relay-cdn[.]com/upload/. The C2 domain was registered three weeks before the first attack โ standard operational security. The archive naming scheme includes the victim's hostname and timestamp: POTENTIAL-ALPHA-2025-07-28.zip. This suggests the attacker is categorizing victims by system name, likely to prioritize wallets with high balances.
4. Persistence The malware drops a LaunchAgent plist (macOS) or a scheduled task (Windows) to re-execute on boot. The persistence payload is a lightweight loader that re-downloads the main binary from a backup domain. Even if the user uninstalls the original app, the loader remains.
5. Impact Assessment Based on SlowMist's sample analysis, the malware can exfiltrate: - All browser cookies (including those for exchanges) - All browser passwords - All browser crypto wallet extensions (MetaMask, Phantom, Keplr, Backpack, etc.) - macOS Keychain contents (Wi-Fi passwords, application secrets, SSH keys) - Telegram tdata folder - Discord local storage (tokens) - Environment variables (potential for CI/CD access)
A successful compromise gives the attacker full access to the victim's online identity. They can log into exchanges bypassing password auth, sign transactions on hot wallets, and impersonate the victim on Telegram and Discord.
Contrarian Angle: What Bulls Got Right
Let me play devil's advocate for a moment. The immediate reaction to this news is fear: 'Web3 is insecure,' 'Don't trust any recruiter,' 'Use hardware wallets.' That's all valid, but the contrarian view is that this attack actually proves the ecosystem is maturing.
Why?
First, the attacker had to invest significant resources โ cross-platform Rust malware, social engineering infrastructure, C2 hosting. They are targeting Web3 professionals because that's where the high-value assets are. This is a signal that the industry has become a high-stakes target, not a low-effort fishing pond.
Second, the response from SlowMist was swift and transparent. Within days of the first reports, they had published a full technical breakdown, IOCs, and YARA rules. The security community moved fast to update detection signatures. This is the kind of coordinated defense that only exists in a mature security ecosystem.
Third, the attack relies on human fallibility, not protocol flaws. That means the fix is behavioral and procedural โ not a hard fork. Projects can mandate hardware wallet usage for all employees, enforce zero-trust networking for recruitment, and deploy isolated interview VMs. These are solvable problems.
But here's the blind spot the bulls miss: the industry's obsession with 'decentralization' has created a trust vacuum. There is no standard identity layer for professional interactions. LinkedIn is centralized but full of fake accounts. Telegram groups are pseudonymous. The attacker exploited this gray zone. Until we have verifiable credentials (DID, zero-knowledge proofs for employment) baked into the hiring process, this attack vector will persist and evolve.
Code does not lie, but incentives do. The incentive here was to steal, and the attacker found the weakest link: the user's machine.
Takeaway: Accountability Call
The Relay trap is a cold, hard reminder that decentralization stops at the operating system. You can have the most secure smart contract in the world, but if your trading bot runs on a laptop with a stolen Telegram session, the liquidity is gone before you read the revert.
I've seen this pattern before โ in the 0x protocol v2 audit where a single integer overflow could drain reserves, in the FTX cold wallet trace where trust in a single multisig led to billions lost. The common thread is that the exploit wasn't in the code; it was in the assumptions about human behavior.
Silence is just uncompiled potential energy. Right now, the silence from the industry on secure recruitment standards is deafening. It's time to compile that energy into action: mandatory hardware wallets for anyone handling more than a few hundred dollars in a hot wallet, verifiable recruiter identities via blockchain-attested credentials, and an industry-wide ban on running unverified executables for job processes.
Trace the gas, find the truth. The truth here is simple: if you downloaded Relay, your keys are already compromised. Assume it. Rotate everything. And next time a recruiter asks you to install an 'AI interview tool,' send them a link to this article instead.
