On July 29, 2025, SlowMist published a threat advisory that should freeze every Web3 professional’s screen. The payload: a cross-platform information stealer named "Relay," disguised as an AI-powered meeting scheduler. The attack chain is elegant in its simplicity—a recruiter reaches out via LinkedIn or Telegram, schedules a screening call, and asks the candidate to install "Relay" for an automated interview. The victim, eager for a role in a bull market that’s inflated job listings, complies. Forty-eight seconds after installation, the malware exfiltrates browser credentials, crypto wallet key files, macOS keychain entries, and Telegram session tokens. The interview never takes place. The job offer was a phantom. The only thing real is the drain of the victim’s hot wallet.
This is not a contract exploit. There is no smart contract to audit, no flash loan attack vector, no governance proposal to vet. The vulnerability is entirely human, and it sits between the keyboard and the chair. But as a smart contract architect who has spent years dissecting bytecode, I can tell you: the same forensic rigor we apply to Solidity must be applied to the software we run on our own machines. The code is the law, but the operating system is the courthouse.
Context: The Bull Market Blind Spot
We are in a bull market. Euphoria masks technical flaws. When projects raise $100M with nothing but a whitepaper and a founder’s tweet, the market’s immune system is suppressed. Hiring has exploded. Every protocol needs a head of DeFi, a Solidity engineer, a community manager. Remote interviews are the norm. The hiring process is inherently trust-based: you trust the recruiter’s LinkedIn profile, you trust the company’s domain name, you trust the software they ask you to install. That trust is now being weaponized.
The "Relay" malware is not a novel piece of code. Its components are known: a dropper, a persistence mechanism, and a data exfiltration module. What is novel is the targeting precision. The attackers didn’t cast a wide net. They built a cross-platform binary that specifically targets Web3 professionals. The macOS variant uses AppleScript to dump the local Keychain. The Windows variant uses PowerShell to pull browser cookies and stored passwords. Both versions scan for directories associated with MetaMask, Phantom, Ledger Live, Trezor Suite, and a dozen other wallet applications. They also grab Telegram session files—a combination that allows the attacker to not only drain wallets but also impersonate the victim within their professional network.
Based on my experience auditing cold-storage signing mechanisms for institutional custodians, I can assert that the weakest link in any multi-party computation scheme is the endpoint. I once discovered a side-channel leakage in key generation by analyzing the timing of random number generation. That was a sophisticated attack requiring deep protocol knowledge. This is simpler: if the machine is compromised, the keys are compromised. No amount of ZK-proofs or threshold signatures can recover from that.
Core: Disassembling the Attack Chain
Let me walk through the hypothetical code paths based on the indicators released by SlowMist. The dropper is typically a small executable, often signed with a stolen or self-signed certificate to bypass Gatekeeper on macOS. The installer presents a UI: "Please enter your name and email to join the interview queue." This is pure social engineering—harvesting personal information while the malware installs a launch agent or a scheduled task.
On macOS, the persistence likely uses a LaunchAgent plist file. The actual payload is a Mach-O binary that uses the Security.framework to request Keychain access. The user sees a prompt: "Relay wants to access your Keychain." Many users click "Allow" because they just installed the app. That grants the malware read access to all passwords stored in the login keychain, including saved wallet seed phrases if the user chose to store them there (a common but dangerous practice). The malware then iterates through known wallet directory paths: