# Malicious Infostealer Disguised as Cracked TradingView Premium Software Security researchers warn of malware stealing credentials via fake TradingView software downloads. - **Source:** [CryptoPotato](https://brifing.si/source/bd22636b-ec8d-42a8-8cca-1937c50e0f6c) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/c67f8f50-1e16-4065-959a-74261dd1a0c2 ## Deceptive Software Distribution Since mid-October, a malicious campaign has been promoting a fake cracked version of TradingView Premium on X. The lure promises free access to advanced charting features, attracting over 360,000 views on a single post. Users are directed to download password-protected archives that allegedly contain a reverse-engineered version of the software. ## Mechanism of the Infostealer Security firm SlowMist identified the program as a sophisticated infostealer designed to harvest sensitive data. Once executed, the malware extracts browser login credentials, cryptocurrency wallet information, and Telegram session data. It then transmits this stolen information to a command-and-control server using the Windows WinINet interface for remote data exfiltration. ## Compromised Distribution Channels The malware is hosted on a legitimate website, arche-hypnose.com, which appears to have been compromised by attackers to serve malicious files. While the promoter claimed the project was open-source and hosted on GitHub, researchers found that the provided links were invalid, serving only to redirect users toward the malicious Windows executable. ## Evasive Server Tactics To maintain persistence and avoid detection, the malware utilizes Telegram and Steam to retrieve and rotate its command-and-control server addresses. This dynamic infrastructure makes it difficult for traditional security tools to block the communication channels. The promoter actively discouraged scrutiny by claiming that repository links were private and expired after use. ## Unverified macOS Version While SlowMist successfully obtained and analyzed the Windows version of the malicious software, the macOS download link currently returns a 404 error. Consequently, researchers cannot confirm if a corresponding version for Apple devices exists or if it contains the same malicious payload. Users should remain cautious of any unofficial software distribution. ## False Security Claims The individual promoting the software, known as Cryptotrice, falsely claimed that the cracked build was safer than official versions. They argued that no credentials ever leave the user's system, a statement directly contradicted by SlowMist's technical analysis. This social engineering tactic is designed to build false trust among unsuspecting financial traders. ## Immediate Remediation Steps Victims who executed the program must immediately disconnect their machines from the network to halt data exfiltration. Security experts advise moving all digital assets to a clean device with a new wallet and seed phrase. Furthermore, users must reset passwords for all exchanges, browsers, email accounts, and active Telegram sessions. ## Broader Security Context This incident follows a recent warning from SlowMist regarding DarkSword, an exploit targeting iPhone users to steal recovery phrases. These campaigns highlight the persistent risk posed by cracked software and password-protected archives. Security professionals emphasize that avoiding unofficial downloads remains the most effective defense against modern infostealer threats targeting financial data. ## Sources covering this story - https://cryptopotato.com/security-firm-warns-of-infostealer-posing-as-cracked-tradingview-premium/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._