The Recruiter’s Trap: How a Fake AI Meeting Tool Is Draining Web3 Wallets

On July 29, 2025, SlowMist published a forensic analysis that sent a chill through the Web3 hiring circuit. A new infostealer, packaged as an AI meeting software named ‘Relay,’ had been silently draining wallets of senior developers and traders. The delivery method? A fake job interview. This isn’t a phishing link in a Discord DM. It’s a fully compiled cross-platform Trojan—targeting both macOS and Windows—that siphons browser credentials, crypto wallet extensions, keychain secrets, and Telegram session files. The attackers didn’t need to break a hash; they broke the victim’s trust by wearing the mask of opportunity. Context: The crypto industry runs on trust—trust in code, in smart contracts, in the promise of decentralized work. But the human layer remains the weakest link. Recruitment scams are not new. In 2017, I audited 45 ERC-20 whitepapers and identified three with fraudulent proof-of-concept claims; back then, the scam was promising a token that never materialized. Today, the scam is promising a job that steals your keys. The attackers studied their marks: they knew Web3 professionals live on Telegram, keep hot wallets for rapid trading, and are constantly scanning LinkedIn for the next role. By weaponizing the ‘AI interview’ narrative—a currently hyped tech trend—they turned a signal of legitimacy into a vector of compromise. SlowMist’s report confirms that the malware has already claimed multiple victims across Ethereum and Solana ecosystems. Tracing the code back to its genesis block: the ‘Relay’ binary is delivered as a fake Electron app, signed with an ad-hoc certificate to bypass basic Gatekeeper checks on macOS. On execution, it harvests browser-stored passwords, wallet extension seeds (MetaMask, Phantom, Coinbase Wallet), macOS keychain items, and Telegram session data files (tdata). The exfiltration is over HTTPS to a VPS host. The social engineering layer is the true masterpiece: attackers crafted realistic LinkedIn profiles with credible work histories, engaged in technical pre-interview chit-chat, and sent calendar invites with a link to download ‘Relay’ for a live coding interview. Once installed, the app requests screen-recording and microphone permissions—ostensibly for the interview—but also silently copies the entire wallet directory. Follow the smart contract, ignore the whitepaper: the real vulnerability is not the code but the human narrative it hijacks. SlowMist’s analysis revealed that the malware uses static string encryption and no packer, making it detectable if you look—but who runs a virus scan before a promising job interview? Here is the contrarian angle: the solution is not better antivirus. It’s systemic cynicism. The industry romanticizes ‘trustless systems,’ yet we still trust a LinkedIn connection. The blind spot is that we’ve outsourced identity verification to platforms that profit from fake profiles. Composability is a double-edged sword: the same efficiency that powers remote hiring also powers remote robbery. This attack reveals a deeper truth—the threat model is not just technical but behavioral. The average Web3 native has 3-4 hot wallets, each with hundreds or thousands of dollars in liquid assets. One malicious npm package or one fake job offer can wipe them out. The mitigation is not a tool; it’s a process. Every unsolicited recruitment outreach should be treated as a zero-trust handshake. Use a dedicated virtual machine for any interview-related app. Only transact from hardware wallets. And if the role seems too perfect, it’s probably a trap. The attackers are betting that ambition overrides caution. Where liquidity flows, truth eventually pools. Expect this vector to spawn imitators, using deepfake audio and video to mimic real recruiters. The next phase will involve on-chain proof of HR identity—verifiable credentials signed by a project’s multisig. Until then, assume every job offer contains a backdoor. The market will price this risk into the cost of hiring and the premium on security tools. The question is not if you’ll be targeted, but when. And that window is closing.