A newly uncovered cyber campaign is targeting Web3 professionals with sophisticated social engineering, leveraging fake job interviews to deploy cross-platform infostealer malware designed to harvest crypto wallets, credentials, and sensitive system data.
The attack begins with threat actors impersonating recruiters who approach job seekers with interview opportunities.
Victims are directed to a malicious domain, relay.lc, which masquerades as an AI-powered platform branded as “Relay.”
The site promotes typical enterprise collaboration features such as real-time transcription and AI summaries, making the workflow appear legitimate for remote hiring processes.
Download links are provided for both Windows and macOS systems, initiating the infection chain.
Technical analysis reveals that both platform-specific installers are heavily weaponized, despite presenting benign user interfaces. On macOS, the downloaded Relay.dmg lacks any legitimate .app bundle.
Instead, it contains a hidden executable stored in a non-visible directory (.back). Users are instructed to execute a script via Terminal, which copies the payload into the /tmp directory, removes macOS quarantine attributes using xattr -c, assigns execution permissions, and silently launches the malware in the background.
This approach effectively bypasses native macOS security prompts without exploiting any system vulnerability.
Once executed, the macOS payload initiates credential harvesting through deceptive AppleScript dialogs that mimic system authentication prompts.
Victims are asked to input their system password under the pretense of compatibility issues. Simultaneously, the malware extracts the macOS login Keychain database (~/Library/Keychains/login.keychain-db) and prepares both the password and encrypted credential store for exfiltration.
The activity, identified by SlowMist’s MistEye threat intelligence platform, highlights a growing trend of recruitment-themed attacks aimed at high-value blockchain and crypto users.
Beyond credential theft, the macOS variant includes extensive data collection routines targeting browsers like Chrome, Brave, Edge, and Arc.
It extracts saved passwords, cookies, autofill data, and cryptocurrency wallet extensions such as MetaMask, Phantom, and Trust Wallet.
It also targets Telegram Desktop session data (tdata directory), which can enable account hijacking, as previously detailed in SlowMist research.
Additionally, Apple Notes content is harvested, posing risks for users storing mnemonic phrases or API keys locally.
Fake Web3 Job Interview Software
The Windows variant employs a different but equally deceptive execution chain. Packaged as an Electron-based application, it displays a fake “Updating” interface where progress is artificially generated using randomized increments.
Upon reaching 80%, the application triggers a hidden execution flow that invokes PowerShell with elevated privileges to launch an unsigned binary (updater.exe) using the command: powershell -ExecutionPolicy Bypass -Verb RunAs.
This secondary payload establishes persistence through multiple mechanisms, including registry Run and RunOnce keys and the Startup folder, disguising entries as “Windows Update” or “WindowsSysUpdateCheck.”
It then proceeds to advanced data theft techniques, including scanning memory of Chrome and Brave extension processes.
By searching for wallet-related function calls such as syncPasswordAndUnlockWallet, the malware extracts sensitive runtime parameters directly from process memory and exfiltrates them via HTTPS POST requests.
Notably, both Windows and macOS samples share common command-and-control infrastructure (cdnresolver.com), indicating coordinated campaign activity despite differing technical implementations.
The Windows sample also integrates Sentry telemetry endpoints, likely used by operators to monitor infection success and data exfiltration in real time.
MistEye has classified relay.lc as high-risk, emphasizing that this campaign does not rely on software vulnerabilities but instead abuses user trust and platform-specific behaviors.
The breadth of targeted data including browser sessions, password managers, crypto wallets, Telegram accounts, and system identifiers demonstrates that a single infection could lead to widespread compromise across both personal and organizational assets.
This campaign underscores the increasing sophistication of Web3-focused threats, where attackers blend social engineering with tailored malware to exploit the intersection of remote work culture and high-value crypto environments.
IOCs
| Type | Value |
|---|---|
| Domain | relay[.]lc |
| Domain | e1[.]cdnresolver[.]com |
| Domain | a2[.]cdnresolver[.]com |
| Domain | cdnresolver[.]com |
| URL | https[:]//e1[.]cdnresolver[.]com/m/test |
| URL | https[:]//a2[.]cdnresolver[.]com/m/test |
| URL | https[:]//e1[.]cdnresolver[.]com/lk/p1 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
