SlowMist Warns of Fake AI Meeting Tool Stealing Web3 User Data

The blockchain security firm SlowMist has issued a critical alert regarding a sophisticated recruitment scam targeting professionals within the Web3 and cryptocurrency ecosystem. Through its MistEye monitoring system, security researchers identified a campaign where attackers impersonate recruiters to compromise the devices of job seekers. The scheme relies on social engineering to trick victims into downloading a fraudulent application, leading to the potential loss of digital assets and sensitive personal information.

The Anatomy of the Relay Malware Attack

The attack begins with a fraudulent recruitment outreach, often conducted via professional networking platforms or encrypted messaging apps. The attackers invite the target to a fake interview, claiming the session will be hosted on a specialized AI-driven meeting tool named "Relay." This software is, in reality, a malicious program designed to bypass standard security protocols on both macOS and Windows operating systems.

• The "Relay" installer functions as a Trojan, deploying a payload that scans the victim's local environment.
• The malware specifically targets browser credentials and stored cookies to gain unauthorized access to web accounts.
• Sensitive Keychain data on Mac devices is extracted, potentially exposing administrative passwords.

Targeting Wallets and Telegram Sessions

Beyond general data theft, the malware is specifically optimized for the crypto industry. SlowMist’s technical analysis reveals that the script actively hunts for wallet-related information, including private keys, seed phrases, and browser-based wallet extensions like MetaMask. Additionally, the attackers attempt to hijack Telegram sessions, a common communication hub for Web3 developers and traders, to further spread the malware or gain access to restricted project groups.

SlowMist has analyzed samples and disclosed the attack chain details, reminding users to be cautious about installing software during online interviews or recruitment processes and to avoid executing unverified applications.

Conclusion

As the Web3 job market continues to expand, specialized phishing and social engineering tactics are becoming more frequent. This latest incident highlights the importance of using verified communication tools and exercising extreme caution when asked to install third-party software as a prerequisite for employment. Security experts recommend that practitioners use hardware wallets for asset storage and conduct interviews through reputable, mainstream platforms to mitigate the risk of data exfiltration.