The Fake Job Offer That Steals Your Wallet: A New Social Engineering Threat in the Bull Run

I remember the summer of 2017, sitting in a cramped Seattle coffee shop, auditing ICO smart contracts for a local crypto meetup. Back then, the biggest threat was a reentrancy bug that could drain a contract. Today, the attack surface has shifted from code to psychology. On July 29, 2025, SlowMist published a chilling analysis of a new malware campaign: attackers posing as recruiters for Web3 companies are tricking professionals into installing a fake AI meeting tool called 'Relay.' Once installed, it silently exfiltrates browser credentials, crypto wallet data, keychain secrets, and even Telegram sessions. This isn't a hack of a protocol—it's a hack of trust itself. Listening to the silence between market cycles, I often ask myself: what breaks first when euphoria returns? In a bull market where everyone is hiring, the noise of opportunity drowns out caution. The attackers know this. They've crafted a narrative that feels familiar: a promising job interview, a cutting-edge AI tool, an urgent invitation to download software. For a Web3 professional juggling multiple offers, the 'Relay' app looks like just another step in the process. But underneath its innocent icon lies a cross-platform information stealer, built to harvest the very keys that secure your crypto identity. The context here is broader than a single piece of malware. SlowMist's analysis reveals that the attackers targeted both macOS and Windows users—a sign of sophisticated development capabilities. The stolen data goes beyond wallet private keys; it includes browser cookies, saved passwords, and Telegram session tokens. Once an attacker gains access to a Telegram session, they can impersonate the victim in group chats, further spreading the scam within trusted circles. This is a multi-vector attack designed to exploit the interconnectedness of the Web3 ecosystem. As someone who spent 2022 leading community support webinars during the bear market, I've seen how quickly panic spreads when trust erodes. But this time, the trust being attacked isn't in a protocol—it's in the human process of hiring. Let me translate the technical details into a clearer picture. The malicious 'Relay' software is a custom trojan, likely employing obfuscation and anti-debugging techniques to evade endpoint detection. Its data theft capabilities are comprehensive: it scrapes browser-stored credentials from Chrome, Brave, and Firefox; it extracts keys from the macOS keychain and Windows Credential Manager; it targets specific cryptocurrency wallets like MetaMask, Phantom, and Ledger Live's software companion. The attack chain is simple: the victim receives a LinkedIn message or email from a fake recruiter, has a brief conversation, and is asked to install 'Relay' for a video interview. Once the software runs, the attacker gains remote access to the victim's machine. Based on my experience auditing smart contracts and tracking liquidity flows, I've learned that the most effective attacks aren't against the protocol's code—they're against the human operator's trust. This campaign is a textbook example of that principle. But here's the contrarian angle: while the immediate risk is obvious, the deeper narrative is that this attack reveals a fundamental blind spot in the Web3 hiring ecosystem. We've built decentralized finance, decentralized governance, and decentralized identity—but we still rely on centralized platforms like LinkedIn and Zoom for recruitment. The 'omnichain app' narrative that VCs love is irrelevant when the weakest link is a fake recruiter profile on a Web2 platform. The real solution isn't a better wallet or a stronger antivirus; it's a decentralized reputation and verification system for professional identities. Imagine a protocol where each recruiter's identity is anchored to an on-chain attestation, signed by their employer's multisig wallet. That would make this entire attack vector obsolete. We're so focused on scaling DeFi that we've neglected the most basic infrastructure of all: trust in the people we work with. As I reflect on the 2024 ETF inflows and the current bull market euphoria, I see parallels to the ICO mania of 2017. Then, investors lost money to flawed smart contracts. Today, professionals risk losing their keys to a fake job offer. The emotional toll is the same—a sense of betrayal, a loss of agency. In my 2022 webinars, I emphasized that psychological safety is as important as code security. That lesson applies now more than ever. The bull market amplifies both opportunity and risk. If we don't address the human layer of security—how we onboard, verify, and trust each other—the next cycle won't just be about price corrections; it will be about a crisis of confidence in the entire hiring pipeline. Listening to the silence between market cycles, I hear a clear signal: build identity infrastructure now, before the next wave of attacks makes it unavoidable. The takeaway is not to panic, but to act. Verify every recruiter through multiple channels. Use a dedicated virtual machine for any interview software you don't fully trust. Keep your private keys on hardware wallets and never enter them into a browser or app that shows up in a PDF attachment. And if you're building a Web3 company, consider implementing a decentralized credential system for your hiring team. The future of work in crypto depends on our ability to trust each other—not through centralized profiles, but through verifiable, on-chain proof. Until that infrastructure exists, every job offer remains a potential attack vector. Stay anchored in the fundamentals, and remember: the structure holds, but the noise can be deadly.