Malicious Infostealer Disguised as Cracked TradingView Premium Software
Security researchers warn of malware stealing credentials via fake TradingView software downloads.
1Deceptive Software Distribution
Since mid-October, a malicious campaign has been promoting a fake cracked version of TradingView Premium on X. The lure promises free access to advanced charting features, attracting over 360,000 views on a single post. Users are directed to download password-protected archives that allegedly contain a reverse-engineered version of the software.
2Mechanism of the Infostealer
Security firm SlowMist identified the program as a sophisticated infostealer designed to harvest sensitive data. Once executed, the malware extracts browser login credentials, cryptocurrency wallet information, and Telegram session data. It then transmits this stolen information to a command-and-control server using the Windows WinINet interface for remote data exfiltration.
3Compromised Distribution Channels
The malware is hosted on a legitimate website, arche-hypnose.com, which appears to have been compromised by attackers to serve malicious files. While the promoter claimed the project was open-source and hosted on GitHub, researchers found that the provided links were invalid, serving only to redirect users toward the malicious Windows executable.
4Evasive Server Tactics
To maintain persistence and avoid detection, the malware utilizes Telegram and Steam to retrieve and rotate its command-and-control server addresses. This dynamic infrastructure makes it difficult for traditional security tools to block the communication channels. The promoter actively discouraged scrutiny by claiming that repository links were private and expired after use.
5Unverified macOS Version
While SlowMist successfully obtained and analyzed the Windows version of the malicious software, the macOS download link currently returns a 404 error. Consequently, researchers cannot confirm if a corresponding version for Apple devices exists or if it contains the same malicious payload. Users should remain cautious of any unofficial software distribution.
6False Security Claims
The individual promoting the software, known as Cryptotrice, falsely claimed that the cracked build was safer than official versions. They argued that no credentials ever leave the user's system, a statement directly contradicted by SlowMist's technical analysis. This social engineering tactic is designed to build false trust among unsuspecting financial traders.
7Immediate Remediation Steps
Victims who executed the program must immediately disconnect their machines from the network to halt data exfiltration. Security experts advise moving all digital assets to a clean device with a new wallet and seed phrase. Furthermore, users must reset passwords for all exchanges, browsers, email accounts, and active Telegram sessions.
8Broader Security Context
This incident follows a recent warning from SlowMist regarding DarkSword, an exploit targeting iPhone users to steal recovery phrases. These campaigns highlight the persistent risk posed by cracked software and password-protected archives. Security professionals emphasize that avoiding unofficial downloads remains the most effective defense against modern infostealer threats targeting financial data.