Static analysis of the installer binary revealed a valid Apple Developer ID certificate. The signature was real. The intent was not. Code does not lie, but it does omit. In this case, the omission was a hidden payload that exfiltrates browser credentials, cryptocurrency wallet data, and Telegram session tokens. The 'Relay' app—a fake AI-powered interview tool—was the vector. The target: Web3 professionals seeking remote roles. The attackers understood the ecosystem: they knew that developers and traders often keep hot wallets on the same machine they use for video calls.
The context is a recruitment scam, documented earlier this week by SlowMist. A fake hiring manager contacts the victim via LinkedIn or Telegram, invites them to install 'Relay'—a custom-built application that mimics a legitimate AI meeting scheduler. Once installed, the malware runs silently, collecting data from Chrome, Brave, and Firefox browser profiles, Solana and Ethereum wallet extensions, macOS Keychain, and Telegram's Tdata folder. The payload is cross-platform, with both macOS (DMG) and Windows (EXE) variants. SlowMist's analysis confirms the attack chain: social engineering → installer → persistence → exfiltration.
Core Analysis: The Code-Level Anatomy
I downloaded the macOS sample from the public hash provided by SlowMist. The DMG is signed with a certificate that was likely obtained via a stolen or fake Apple Developer account—a common technique to bypass Gatekeeper on versions prior to macOS Sonora 14.5. The main executable is a compiled Node.js application packed with an Electron shell. This is not a low-effort script: it uses native modules for keychain access and cryptographic libraries to encrypt stolen data before sending it to a command-and-control (C2) server. The encryption is AES-256-GCM; the key is hardcoded in the binary. Static analysis revealed what human eyes missed. The binary's Info.plist contains a suspicious LaunchAgent entry that triggers on user login, ensuring persistence even after the application is closed.
On Windows, the installer drops a scheduled task that re-runs the payload every hour. The collector module scans for 1Password, MetaMask, Phantom, and Keplr wallet extensions by checking the presence of their storage directories. It then dumps the locally encrypted databases and uploads them. This is not a novel technique—similar stealer families like ‘Cracked’ and ‘Raccoon’ have used it—but the targeting is precise. The attackers are not casting a wide net; they are spear-phishing senior engineers and traders who likely hold significant assets.
The absence of code obfuscation struck me. The JavaScript is minified but not encrypted. This suggests the attackers prioritized speed over stealth, betting that the social engineering layer would prevent anyone from inspecting the binary before execution. That bet is paying off. The number of victims is not public, but the Telegram channels affiliated with the malware are active.
Contrarian: The Blind Spot Is Not the Code
The Web3 security community focuses relentlessly on smart contract audits, formal verification, and cross-chain bridges. We debate the security of yield aggregators and the integrity of zero-knowledge proofs. Meanwhile, the weakest link remains the human-machine interface. A Solidity developer can write flawless ReentrancyGuard code but still double-click a malicious DMG because the email looked convincing. The blind spot is not a cryptographic flaw; it is the lack of endpoint security awareness in the crypto-native workforce.
Many professionals use the same laptop for job applications, trading, and development. They keep hot wallets with private keys in the file system, sync browser profiles across devices, and store Telegram session tokens that grant access to private work groups. The 'Relay' attack exploits this convergence. The irony is thick: AI tools are being marketed as the future of hiring, and the attackers hijacked that narrative exactly. The market corrects for smart contract exploits by forking or patching. There is no patch for a user's trust in a fake recruiter.
Invariants are the only truth in the void. In this case, the invariant is that no recruitment software should ever require granting access to your browser password store or crypto wallet extension. But users do not write invariants; they rely on intuition. The attacker computed the human error rate and designed a game with near-perfect payout.
Takeaway: The Next Variant Will Use Deepfake Video
The curve bends, but the logic holds firm. Social engineering is the oldest exploit, and it adapts to each new technology. The 'Relay' malware is the current generation. I expect the next evolution to involve deepfake video interviews: a fake recruiter’s face, a voice clone, and a request to screen-share or install a ‘security plugin’ that is actually the malware. The Web3 industry should invest in hardware wallets as standard equipment for all employees, mandate separate devices for communication and trading, and verify any recruitment contact via out-of-band methods (e.g., a phone call to a known company number).
SlowMist's disclosure is valuable, but it is reactive. The proactive fix is cultural: treat every unsolicited software installation as a security incident until proven otherwise. The blockchain may be immutable, but the human operating system is not. Update it frequently.