Blockchain security firm SlowMist has warned that a supposed cracked build of TradingView Premium being promoted on X is actually Windows malware built to steal sensitive user information. The lure offered free access to paid charting tools, and one post advertising the download drew more than 360,000 views.
According to SlowMist, the sample it analyzed collected browser login credentials, cryptocurrency wallet data and Telegram information, then transmitted that data to a command-and-control server. The campaign had been promoted since mid-October as a reverse-engineered TradingView Premium version 3.3.0.
Free premium features used as the bait
The software was promoted by an X account called Cryptotrice, which describes itself as an on-chain developer. Posts repeatedly linked to a guide for installing what was presented as a reverse-engineered TradingView Premium release, complete with a password-protected archive and a KeyGen tool that users were told to run and click to “generate” a license.
The promotional material claimed the build unlocked paid features including eight charts per tab and 400 price alerts. It also described the package as being provided “for educational purposes only,” a familiar framing in posts distributing cracked software.
SlowMist says the download was not what it claimed
SlowMist said the Windows sample it obtained was an infostealer. In the firm’s account, the malware harvested browser credentials, crypto wallet information and Telegram data before sending the information out through Windows’ WinINet interface to a remote server.
Although the promoter described the project as open source and referred users to a GitHub repository, SlowMist said the actual download link used in the promotional articles did not point to GitHub. In replies to followers, Cryptotrice reportedly said the repository had been made private and that links inside the application expired after a single use.
Command infrastructure rotated through Telegram and Steam
In its analysis, SlowMist said the malware relied on Telegram and Steam to retrieve and rotate command-and-control server addresses. The download domain, arche-hypnose[.]com, appeared to be a legitimate website that had been compromised and then used to host the malicious file.
SlowMist said it was only able to obtain and inspect the Windows version. At the time of its report, the macOS download returned a 404 error, so the firm said it could not confirm whether a Mac variant existed or whether it behaved the same way.
What affected users were told to do next
SlowMist advised anyone who may have run the program to disconnect the affected computer from the network immediately. The firm also said users should move their assets using a clean device and set up a new wallet with a new seed phrase.
It further recommended changing passwords for exchange accounts, browsers, email and Telegram, and terminating active Telegram sessions. In one of the reply threads promoting the software, a user had asked Grok whether the crack was safe; Cryptotrice responded by claiming it was safer than the official TradingView because no credentials ever left the user’s system, a statement directly at odds with SlowMist’s findings.
The warning fits a broader pattern cited by the security company: cracked applications, key generators and password-protected archives remain common delivery methods for infostealers. SlowMist last week also issued a separate alert to iPhone users about an exploit it called DarkSword, which it said could extract wallet files and recovery phrases from devices visiting compromised websites.
Source: cryptopotato.com