Malware News Fake Web3 Job Interview Software Delivers Infostealer to Steal Crypto Wallets and Passwords

[Brownie2019]

Content source

https://gbhackers.com/fake-web3-job-interview-software/

A newly uncovered cyber campaign is targeting Web3 professionals with sophisticated social engineering, leveraging fake job interviews to deploy cross-platform infostealer malware designed to harvest crypto wallets, credentials, and sensitive system data.

The attack begins with threat actors impersonating recruiters who approach job seekers with interview opportunities.

Victims are directed to a malicious domain, relay.lc, which masquerades as an AI-powered platform branded as “Relay.”

The site promotes typical enterprise collaboration features such as real-time transcription and AI summaries, making the workflow appear legitimate for remote hiring processes.

Download links are provided for both Windows and macOS systems, initiating the infection chain.

Technical analysis reveals that both platform-specific installers are heavily weaponized, despite presenting benign user interfaces. On macOS, the downloaded Relay.dmg lacks any legitimate .app bundle.

Instead, it contains a hidden executable stored in a non-visible directory (.back). Users are instructed to execute a script via Terminal, which copies the payload into the /tmp directory, removes macOS quarantine attributes using xattr -c, assigns execution permissions, and silently launches the malware in the background.

This approach effectively bypasses native macOS security prompts without exploiting any system vulnerability.

Once executed, the macOS payload initiates credential harvesting through deceptive AppleScript dialogs that mimic system authentication prompts.

Victims are asked to input their system password under the pretense of compatibility issues. Simultaneously, the malware extracts the macOS login Keychain database (~/Library/Keychains/login.keychain-db) and prepares both the password and encrypted credential store for exfiltration.

Read the full Story:

https://gbhackers.com/fake-web3-job-interview-software/

 

[Bot]

Read the full Story:

https://gbhackers.com/fake-web3-job-interview-software/

Key Takeaways

This campaign, as described, relies primarily on social engineering rather than a macOS vulnerability. The fake interview workflow creates enough urgency and legitimacy to persuade victims to bypass normal security warnings and run commands provided by the supposed recruiter.

The macOS instructions are especially suspicious:

• Running an unknown script from Terminal
• Copying an executable into [/tmp]
• Removing quarantine attributes with xattr -c
• Changing file permissions with chmod
• Launching a hidden process in the background
• Requesting the macOS account password through a deceptive prompt

A legitimate interview or collaboration platform should not require these steps. Removing quarantine metadata does not make a file safe; it only removes information macOS uses to apply certain security checks. Users should never enter their password into a prompt that was triggered by an unknown download or recruiter instruction.

If Someone May Have Run It

• Disconnect the Mac from the internet, especially if credential theft or exfiltration is suspected.
• Do not enter additional passwords into prompts from the affected system.
• From a separate trusted device, change important passwords and revoke active sessions, prioritizing email, password managers, cryptocurrency accounts, developer platforms, and financial services.
• Move cryptocurrency assets to securely controlled wallets if wallet credentials or seed material may have been exposed.
• Enable multifactor authentication where available, preferably with a hardware security key or authenticator application.
• Preserve the downloaded file, Terminal history, and relevant logs if professional analysis is needed.
• Run reputable, fully updated security software and consider having the system examined by a qualified incident-response professional.

Because the exact files, infrastructure, and indicators cannot be independently confirmed from the quoted material alone, the article should not be treated as a substitute for a local forensic examination. Suspicious samples or URLs can be submitted to VirusTotal, but avoid uploading confidential documents, private keys, or sensitive personal data.

The safest general rule is simple: do not install software or run Terminal commands supplied by an unsolicited recruiter. Verify the employer and software through independently obtained official contact details before downloading anything.