Relay Malware: The Social Engineering Attack Targeting Web3 Professionals – A Forensic Code Autopsy

On July 29, 2025, SlowMist released a cold forensic analysis of a new information-stealing malware disguised as an AI meeting tool named 'Relay'. The target? Not random users, but precisely Web3 professionals actively seeking jobs. Over the past week, attackers impersonated recruiters from legitimate crypto firms, sending interview invitations that contained a download link for this 'AI-powered meeting assistant'. The moment a user installed and ran the application, their machine was compromised. This is not a theoretical vulnerability. It is a live, weaponized attack chain that has already claimed victims. Where logic meets the fragility of human trust, social engineering remains the oldest and most effective exploit.

Context: The Web3 Hiring Boom as an Attack Surface The crypto market in mid-2025 is characterized by a resurgence in hiring, especially for DeFi, Layer2, and security roles. LinkedIn is flooded with recruiter messages, and dedicated Web3 job boards are expanding. Attackers have weaponized this environment. They create fake but highly convincing LinkedIn profiles, often mirroring real employees from well-known projects like Uniswap, Arbitrum, or SlowMist itself. The bait is a 'Relay' – a fictional AI meeting tool promising features like real-time transcription and code sharing. The victim, eager to advance their career, downloads the installer. The malware is cross-platform: both macOS and Windows versions exist, written with separate code bases. This indicates a well-funded team with at least mid-level development capability. The theft scope is comprehensive: browser credentials, cryptocurrency wallet files, macOS Keychain (including seed phrases), Telegram session tokens, and even system clipboard data. The goal is clear – exfiltrate everything needed to drain a victim's on-chain assets and infiltrate their professional network.

Core: Dissecting the Attack Chain – Code-Level Analysis Tracing the immutable breath of the contract is my usual domain; today, I trace the breath of a malicious binary. Based on my audit experience dissecting proxy patterns in 0x Protocol v2, I recognize a familiar pattern: the exploit of a trust boundary. In 0x, it was the order-flow edge case that allowed a reentrancy under specific callbacks. Here, the trust boundary is the user's decision to run unsigned code from an unknown source.

The malware, once executed, performs the following sequence parsed from SlowMist's sample analysis:

1. Persistence Mechanism: On Windows, it creates a scheduled task linked to Run registry keys. On macOS, it installs a LaunchDaemon plist that executes after reboot.
2. Clipboard Hijacking: It monitors the clipboard for cryptocurrency addresses. When a user copies an address to send funds, the malware replaces it with an attacker-controlled address. This is a real-time man-in-the-clipboard attack, bypassing even hardware wallet confirmations if the user does not verify the output.
3. Wallet File Collection: It scans directories such as ~/.ethereum/keystore, ~/Library/Application Support/MetaMask/ (or similar paths for Phantom, Rabby, etc.), and extracts any files matching wallet patterns. It then parses the Keychain on macOS to steal stored passwords and seed phrases. For Windows, it targets the Credential Manager and browser-stored passwords.
4. Telegram Session Theft: By copying the tdata folder from Telegram Desktop, it can hijack active sessions without requiring a 2FA code. This grants the attacker access to the victim's chats, groups, and channels – a goldmine for further social engineering against colleagues or project teams.
5. Exfiltration: The gathered data is compressed and sent to a command-and-control (C2) server via HTTPS, often using a legitimate cloud service (e.g., AWS S3, Google Cloud Storage) to avoid detection by DNS-based firewall rules.

Interestingly, the malware employs no advanced obfuscation. It relies on speed and the user's lack of suspicion. The code itself is simple – a combination of shell commands, Python scripts, and native OS APIs. The sophistication lies in the social engineering pretext and the selection of targets. This echoes the 2022 LUNA collapse forensic analysis I conducted: the bug was not in the code but in the economic design's lack of circular stability. Here, the flaw is not in the software but in the human trust protocol.

Contrarian: Why Smart Contract Audits Are Not Enough Silence in the code speaks louder than audits, but only if the code is the attack surface. In this case, the exploit does not touch a single smart contract. The victim's funds are lost not because of a reentrancy bug or an oracle manipulation, but because they downloaded an executable from an unverified source. The Web3 security industry has spent billions on formal verification, bug bounties, and rigorous audits. Yet the most effective attack in 2025 bypasses all of that. The contrarian truth is that the weakest link in DeFi is not the immutable contract – it is the mutable human operating the client.

This attack highlights a blind spot in our collective security posture: we assume users will not run malicious binaries. But in a bear market, when job desperation is high, even savvy engineers can be tricked. I have personally audited protocols where the treasury was protected by multisig and timelocks, yet the team members used hot wallets on their main laptops for daily operations. A single employee falling for this scheme could lead to a cascade of compromises – stolen treasury keys, leaked API tokens, compromised social media accounts.

The broader implication is that security cannot stop at the blockchain layer. It must extend to the user's endpoint environment. We need to treat the interview process as a high-risk activity that requires a separate, disposable operating system – think of it as a 'DeFAI' (Decentralized Finance AI) sandbox. Until then, every recruitment message should be met with the same paranoia as an unsolicited airdrop.

Takeaway: The Architecture of Freedom, Compiled in Bytes The architecture of freedom, compiled in bytes, rests on the assumption that users control their keys and their machines. This attack subverts both. Looking forward, I foresee two immediate developments:

1. Standardized Secure Interview Environments: Web3 companies will begin mandating that candidates join interviews via a read-only video conferencing link that cannot execute code. Or they will provide a secure VM pre-configured for the call.
2. Hardware Wallet as Primary Identity: The industry will accelerate toward using hardware wallets not just for transactions but for identity verification (e.g., signing a challenge to prove you control your address before accepting an interview).

The question every Web3 professional must ask now is: can you afford to trust a recruiter's link? My recommendation – treat every unsolicited hiring offer as a potential zero-day. Verify through a separate channel (e.g., the official company website), use a dedicated machine or VM for interviews, and never store private keys on a device that runs untrusted software. Code audits protect protocols. Human audits protect access. Both are essential.