The Relay Trap: Why Your Hardware Wallet Won’t Save You From the New Web3 Recruitment Malware

Hook

On July 29, 2025, SlowMist published a sample analysis of a new infostealer malware. Dubbed 'Relay,' it masquerades as an AI meeting tool for job interviews. Within hours of installation, it exfiltrates private keys, browser cookies, Telegram sessions, and macOS Keychain data. The attack chain is clean, cross-platform, and targeted. I’ve audited smart contracts for years, but this one exploits the weakest link: human trust. Speculation is gambling with a spreadsheet — and this is pure, calculated theft.

Context

The Web3 job market is a prime hunting ground. Recruiters and candidates alike rely on platforms like LinkedIn and Telegram. Attackers create fake recruiter profiles, invite targets to 'relay.stream' (or a similar domain), and convince them to download a malicious .dmg or .exe. The malware is not signed by a trusted developer. But social engineering bypasses all gatekeeping. The target is not a protocol; it’s a person with a hot wallet and a Telegram session. This is not a random spray. It’s a spear-phishing campaign aimed at people who hold assets, sign transactions, and communicate in private channels.

The timing is deliberate. We are in a bull market mid-cycle (July 2025). Crypto natives are actively job-hunting, startups are hiring aggressively, and trust in remote work is at a peak. Attackers read the same market data we do. They know that an 'AI meeting tool' narrative lowers suspicion. They know that a .dmg file from a recruiter’s email feels legitimate. Audits reveal intent; code reveals reality. The code of Relay reveals a clear, profit-driven design.

Core

Let’s break down the mechanics. The malware, once executed, performs the following four phases:

1. Browser Profile Extraction – It scans for Chrome, Brave, Firefox, and Edge profiles. It extracts saved passwords, cookies, and autofill data. These are stored in plaintext or encrypted with a master key that the malware can access via system APIs. Any exchange login, email account, or cloud service is now compromised.

1. Crypto Wallet Targeting – The dropper contains a list of extension IDs for MetaMask, Phantom, Keplr, Rabby, and others. It reads the encrypted private key storage files (e.g., chrome-extension:///Local Storage/leveldb/). On macOS, it also dumps the Keychain items where many users store seed phrases or password hints. On Windows, it uses DPAPI to decrypt stored credentials. The result: your hot wallet is drained within minutes of connecting to the internet.

1. Telegram Session Hijack – Telegram stores session data in %APPDATA%/Telegram Desktop/tdata on Windows and ~/Library/Application Support/Telegram Desktop/tdata on macOS. Relay copies these files. With a valid session, the attacker bypasses two-factor authentication. They can read your chats, send messages as you, and access groups where you trust them. This is the force multiplier — one victim becomes a vector to reach their network.

1. Keychain and System Data Dump – On macOS, the malware runs a script to export Keychain contents using security dump-keychain. This dumps certificates, VPN passwords, and stored secrets. On Windows, it uses vaultcmd to steal Windows Credential Manager data. The attacker now has a complete digital identity map.

SlowMist’s report confirms the malware was compiled with Golang and packed with UPX to evade signature-based detection. The initial VirusTotal submission had zero detections. This is a professional operation — not a script kiddie. The C2 infrastructure uses a combination of Telegram bots (for data exfiltration) and direct HTTPS POST to a rotating set of domains. The domains mimic legitimate SaaS providers like relay-stream.io or meet-relay.com.

Why is this effective? Because it exploits a gap between security tools. Traditional EDRs (CrowdStrike, SentinelOne) focus on executable behavior, not on legitimate script actions. Relay uses native OS tools (like security and sqlite3 on macOS) that are whitelisted. It doesn’t inject code; it operates within the user’s permissions. The user clicked 'Allow'. The OS trusts the user.

Contrarian

The common advice is 'use a hardware wallet.' That helps, but not fully. If your browser is compromised, an attacker can sign transactions via the connected hardware wallet without your knowledge if they inject a transaction request. More insidious: they steal your Telegram session. Once inside, they can impersonate you to colleagues, request funds, or spread the malware further. The real blind spot is the assumption that 'I only use cold storage' protects against all vectors. It doesn’t. The attack surface now includes your entire digital identity. Trust is a variable I solve for, never assume.

Another blind spot: the narrative that 'security is a feature, not a product.' This event proves that security is a process, not a single purchase. Buying a Ledger does not make you bulletproof if you run untrusted software on the same machine. The market often treats security as a checkbox. It’s not. The attackers know that users will click 'Next' on a prompt. They know that a polished UI with a video meeting logo lowers guard.

Most market commentary on this event will focus on 'report the scam, use 2FA, don’t download unknown files.' That’s table stakes. The real contrarian angle: this attack exposes the fragility of the web-based identity model. Even if you never install malware, your browser’s session cookies can be stolen. That’s why every major exchange is pushing passkeys and hardware security keys (FIDO2). But few Web3 natives adopt them. The cost of not adopting is no longer theoretical.

Takeaway

What do you do? Immediately after reading this:

1. Do not run any unsolicited installer for a 'meeting tool.' Verify the recruiter through a separate channel — call them, check their LinkedIn history, confirm the job posting on the company’s official site.
2. Use a dedicated virtual machine or a burner laptop for interviews. Spin up a fresh Ubuntu VM, take the interview, and wipe it afterward. Do not connect your primary wallet or Telegram on that machine.
3. Treat your Telegram session like a private key. Enable two-factor authentication, log out inactive sessions, and never scan QR codes from unknown sources.
4. If you already downloaded Relay, disconnect from the internet immediately. Change all passwords from a clean device. Revoke all Telegram sessions. Transfer crypto to a new wallet generated offline. The malware may have already exfiltrated data, but you can limit the damage.
5. Monitor your connected dApp permissions. Use tools like Revoke.cash to remove approvals from any contracts you don’t recognize. The attacker might wait weeks before draining.

Security is not a feature; it is the foundation. This event is not a one-off. It’s a blueprint. Expect copycat campaigns targeting other verticals (DevOps engineers, DeFi traders, NFT collectors). The market doesn’t owe you an exit, only a price. In security, the price is continuous diligence. I trade the structure, not the story. The structure here is broken trust. Fix it before it fails.