Security firm SlowMist has warned that a fake “cracked” version of TradingView Premium promoted on X since mid-October is actually Windows malware built to steal sensitive information, including cryptocurrency wallet data. The account behind the campaign, “cryptotrice,” presented the file as a reverse-engineered TradingView Premium build 3.3.0 and encouraged users to download a password-protected archive, run the program, and click “generate” in a KeyGen window. One promotional post passed 360,000 views, according to SlowMist.
The malware functions as an infostealer that collects browser login details, cryptocurrency wallet information and Telegram data, then sends it to a command-and-control server through Windows’ WinINet interface. SlowMist found that the download link in the promotional articles did not lead to the claimed GitHub repository, and the distribution site arche-hypnose[.]com appeared to be a legitimate website that had been compromised. The malware also used Telegram and Steam to retrieve and rotate command-and-control servers. While the Windows sample was confirmed malicious, the macOS link returned a 404 error, so SlowMist could not verify that version.
The incident is part of a longer pattern. SlowMist says similar “cracked” TradingView scams have been running for about 18 months. Earlier, Bitdefender tracked fake TradingView Premium ads across Facebook Ads, Google Ads and YouTube. Malwarebytes and HP later found a site called TradingClaw that claimed to be an AI helper for TradingView but installed Needle Stealer, malware that harvests browser history, cookies, saved logins and seed phrases. It targeted desktop wallets such as Ledger, Trezor and Exodus, as well as browser wallets including MetaMask, Coinbase Wallet and Phantom.
For anyone who may have run the fake software, SlowMist recommends disconnecting the affected machine, moving assets to a clean device with a new wallet and seed phrase, and changing passwords for exchanges, browsers, email and Telegram while terminating active sessions. “Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them,” the firm warned. The warning follows another SlowMist alert last week about an iPhone exploit called DarkSword that could pull wallet files and recovery phrases from compromised websites.
