Crypto Job Scams: Fake Relay Interview App Targets Web3 Professionals Job hunting in Web3 just got riskier. A new wave of Crypto Job Scams 2026 targets professionals via fake recruiter outrea
Job hunting in Web3 just got riskier. A new wave of Crypto Job Scams 2026 targets professionals via fake recruiter outreach, luring victims into installing malware disguised as an AI meeting tool. SlowMist flagged this as one of the more sophisticated Cryptocurrency Job Scams of 2026, hitting macOS and Windows alike.
Relay Hiring Scam at a Glance
Area
Key Details
Target
Web3 professionals and crypto job seekers
Scam Method
Fake recruiters offer interviews and request software installation
Malicious App
“Relay,” presented as an AI meeting platform
Website
relay.lc
macOS Attack
Hidden executable, Terminal script and fake password prompt
Windows Attack
Fake update screen, PowerShell and persistence mechanisms
Data Targeted
Browser credentials, wallet data, Keychain, Telegram sessions and more
Security Team
SlowMist MistEye
Main Warning
Do not install or execute unverified interview software
According to SlowMist's MistEye monitoring system, attackers are impersonating recruiters to run a targeted scam against Web3 practitioners. Victims are contacted about interview opportunities, then guided toward a supposed AI-powered meeting platform called "Relay." MistEye flagged the site, relay.lc, as high-risk after community reports surfaced, prompting a full technical investigation.
Source: SlowMist Official X
How the Fake Relay Interview Software Scam WorksFake crypto recruiters direct candidates to relay.lc, which presents itself as a polished AI meeting and collaboration tool with transcription, note-taking, and desktop apps.
Being asked to install meeting software before an interview feels routine, which is exactly why the scam works. Once downloaded, the installers for both operating systems hide malicious payloads instead of legitimate applications.
Crypto Job Scam Uses Different Attack Methods on Mac and WindowsThe campaign tailors its approach to each platform. On macOS, users drag the downloaded file into Terminal and press Enter, a step disguised as installation but which strips the file's security quarantine flag and silently launches a hidden executable.
On Windows, victims see a fake "Updating" bar with no link to any real download; it simply climbs on a randomized timer before triggering a hidden PowerShell command requesting administrator privileges. Both paths end in quiet installation of data-stealing malware.
What the Relay Malware Steals From Crypto Job SeekersThe malware casts a wide net. It targets browser credentials, cookies, and saved passwords from Chrome, Brave, Edge, and Arc, and references 286 extension IDs tied to wallets like MetaMask, Phantom, and Trust Wallet, plus password managers such as 1Password and LastPass. It also collects macOS Keychain data, Telegram sessions, Apple Notes content, and system information.
For anyone pursuing Crypto Jobs, this scope means one infection can expose personal and professional accounts alike.
How the Mac Version Tricks Users Into Giving PasswordsThe macOS installer hides its payload inside a folder Finder doesn't show by default. The Terminal script strips the quarantine attribute, disabling a built-in security warning, then launches the hidden program in the background.
It displays a fake dialog claiming compatibility issues and requesting the user's password, mimicking a genuine macOS prompt. The captured password is paired with the login Keychain database and prepared for transmission to attackers.
How the Windows Malware Creates Persistence and Targets WalletsThe Windows sample goes further. After the fake bar reaches 80%, it launches an unsigned 116MB file named updater.exe with hidden administrator privileges.
This component attempts three persistence methods, Registry Run keys, RunOnce keys, and the Startup folder, disguising itself as "Windows Update." It then scans running Chrome and Brave processes for wallet-unlock parameters, sending extracted values to a remote server alongside a machine identifier.
Timeline
Fake Recruitment Offer
↓
Attacker Poses as Web3 Recruiter
↓
Victim Receives Interview Invitation
↓
Victim Is Directed to relay.lc
↓
Fake “Relay” Meeting App Is Downloaded
↓
macOS/Windows-Specific Malware Runs
↓
Sensitive Data Is Targeted
↓
SlowMist MistEye Detects and Analyzes Campaign
Why Crypto Job Scams Can Put Wallets and Accounts at RiskThe combined data-theft scope of these Crypto scams goes far beyond a single wallet. Stolen cookies and password manager vaults can unlock email, exchange accounts, and company tools.
Compromised Telegram sessions can be used to impersonate victims and target their contacts. Because Web3 professionals work across personal and organizational systems, one infection can cascade into broader account takeovers.
How Web3 Professionals Can Avoid Fake JobsConfirm recruiter identities through official company channels rather than unsolicited messages. Avoid installing meeting software from unfamiliar links, and use only verified official websites.
Never enter your system password into a dialog triggered by an installer, and treat any "update" screen right after installation as suspicious. Keep extensions and wallets updated, and consider cold storage for larger holdings. When scanning any Crypto Job list, treat unexpected software requests as a red flag, not routine.
Crypto Job Market 2026: Everything About ItThe crypto job market 2026 looks very different from earlier speculative hiring waves. Demand is concentrated in smart contract engineering, compliance, and security auditing, with Rust and Solidity the leading skills. Salary ranges have matured, with entry-level roles averaging $70,000–$95,000 and senior positions paying considerably more.
Over 80% of Web3 teams operate remote-first, and token-based pay with structured vesting has replaced speculative bonuses. The Blockchain job market 2026 increasingly overlaps with traditional finance as institutions build digital asset teams, echoing the trend in Mastercard's own hiring, alongside steady Crypto Job Salary growth in senior roles.
Currently Mastercard Is HiringAlongside this scam alert, Mastercard Hiring Today includes a Digital Assets and Stablecoin Payments Director role, part of Mastercard's push into Mastercard Crypto Jobs.
The Mastercard Hiring Process involves collaboration with virtual asset service providers, stablecoin issuers, and compliance teams, with posted pay between roughly $179,000 and $318,000 by location. It's a reminder that legitimate opportunities exist at major institutions even as Crypto Hiring Scams proliferate elsewhere.
Source: Wu Blockchain X
ConclusionThis campaign shows how convincingly job scams can now imitate real hiring, using fake recruiters, professional websites, and platform-specific malware to steal wallets, credentials, and sessions. As roles like Mastercard's stablecoin position show, per the latest cryptocurrency scam news today, the hiring space is real and growing, but so is the risk, so verifying every interview step is no longer optional.
Disclaimer: This article is for informational purposes only and does not constitute financial, investment, legal, or cybersecurity advice. Always conduct independent research and consult professionals before making decisions.
