Job Scams

Overview

A new wave of job scams is targeting Web3 developers, exploiting the trust placed in recruitment workflows and developer tools. Attackers pose as recruiters, initiate friendly conversations about interviews, and then direct candidates to install a fake meeting app called Relay. Behind the polished façade, Relay is an info‑stealing campaign designed to compromise wallets, developer accounts, and personal data.

Attack Flow

• Recruiter impersonation: Attackers initiate chats about interviews.
• Relay app lure: Victims are asked to install Relay, marketed as an AI meeting tool.
• MacOS infection: Victims drag a file into Terminal, launching a hidden payload.
• Windows infection: Installer shows a fake progress bar, then runs unsigned helpers with admin rights.
• Trusted workflows abuse: Attackers exploit npm packages and Bitbucket repositories to deliver malicious code.

Dual‑Platform Data Theft

macOS payload:

• Pops a fake “Application Error” box to capture system passwords.
• Reads Keychain data, browser stores, crypto wallet extensions, Telegram sessions, and Apple Notes.

Windows payload:

• Plants persistence files disguised as system updates.
• Scans Chrome and Brave extension memory for wallet unlock material.
• Steals browser cookies, tokens, and desktop wallet clues.

Neither attack requires exploiting new software flaws — victims are tricked into running the code themselves.

Indicators of Compromise (IoCs)

• Domains: relay.lc, cdnresolver.com, e1.cdnresolver.com, a2.cdnresolver.com.
• Payload hashes:
  • macOS: 6bc9378366076a028365ecff61ab868fe51bf988c18588c29c393a5488eafe0c (Relay.dmg).
  • Windows: 4a7ef5aec036dc7cff3eeece774caa2500bcd9f3d7712799637dab2645dfc265 (Relay.exe).
• Persistence files: com.google.keystone.agent.plist, sysupdwin.exe.

Defensive Guidance

• Avoid unsolicited installs — treat recruiter‑shared apps as hostile until verified.
• Block malicious domains (relay.lc, cdnresolver.com).
• Rotate credentials from a clean device.
• Revoke sessions — browser, Telegram, and developer accounts.
• Reimage infected systems to remove persistence modules.
• Move crypto assets to new wallets with fresh keys.

Expert in the Cloud Insight

This campaign shows how social engineering now blends seamlessly with developer workflows. By exploiting trust in recruitment and coding platforms, attackers bypass traditional defenses and compromise entire ecosystems. For Web3 developers, the lesson is clear: every unsolicited install request is a potential attack vector. Vigilance, credential hygiene, and strict validation of tools are essential to protect both personal and organizational assets.