Fake Recruiters Exploit Web3 Devs with Malicious 'AI Meeting' App
Attackers are impersonating recruiters to trick Web3 developers into installing a malicious 'AI meeting' application that steals cryptocurrency wallet data, browser credentials, and system information.
A sophisticated phishing campaign is targeting Web3 developers by leveraging the trusted workflows of remote hiring. Threat actors are posing as recruiters, initiating conversations about job opportunities, and then directing potential candidates to download a seemingly legitimate AI-powered meeting application named "Relay." This application, available for both Windows and macOS, is designed to appear as a standard tool for remote collaboration, complete with features like note-taking and transcriptions.
Once installed, the "Relay" application transforms into a potent information-stealer. Security researchers from SlowMist have identified that the malware actively targets sensitive data stored on developers' machines. This includes browser passwords, cryptocurrency wallet extensions, Telegram session data, and various system details, all of which can be exploited to compromise financial assets and sensitive work accounts.
The attack vector is carefully crafted to bypass common security precautions. On macOS, users are guided through a Terminal process that involves dragging and dropping a file, then executing a command. This action silently installs a hidden payload, strips away security markers, and launches the malicious program in the background, bypassing the typical application bundle structure. The installer itself is a concealed payload, not a standard app bundle.
For Windows users, the installer presents a deceptive "Updating" progress bar. Upon reaching approximately 80 percent, the malicious code attempts to launch an unsigned helper application with administrative privileges. This process is designed to exploit the user's trust in software installation procedures common during the remote hiring process, making it difficult to distinguish from legitimate software.
The impact of this campaign extends beyond individual credential theft. The compromise of a single developer's machine can lead to the exposure of personal cryptocurrency wallets, work-related accounts, and other confidential information. This tactic aligns with a broader trend of attackers exploiting trust in developer tools and workflows, such as malicious npm packages or compromised coding tests, to deliver their payloads.
Both the macOS and Windows versions of the malware employ distinct but equally effective methods for data exfiltration. The macOS payload can trigger a fake "Application Error" prompt to solicit the user's system password, while simultaneously accessing the login Keychain and harvesting browser data, crypto wallet extensions, and even sensitive notes where seed phrases might be stored. The Windows variant focuses on persistence by disguising itself as system updates and scanning browser processes for wallet credentials and cookies.
Remediation advice for infected systems varies based on the operating system. For macOS, users are advised to disconnect from the network immediately, change passwords from a clean device, revoke sessions, and move wallet assets. Windows users should isolate the affected host, remove malicious files, rotate credentials, and plan for a full operating system reinstallation. The overarching recommendation is to treat any unsolicited installation requests during the hiring process with extreme caution.
This campaign highlights the evolving tactics of cybercriminals who are adept at social engineering and exploiting the trust inherent in professional workflows. By masquerading as legitimate recruiters and using seemingly innocuous software, attackers are effectively lowering the barrier to entry for stealing high-value developer credentials and financial assets within the Web3 ecosystem.