Security firm SlowMist has said that a cracked version of TradingView Premium promoted on X since mid-October is actually a Windows malware designed to steal sensitive information.<\/p>\n
The lure was free access to paid charting features, with one of the posts pushing the free download passing more than 360,000 views.<\/p>\n
Cryptotrice, who identifies themselves on X as an on-chain dev, has been repeatedly promoting<\/a> a guide to what they call a reverse-engineered TradingView Premium build, version 3.3.0, released in October.<\/p>\n In the posts, they asked users to download a password-protected archive, run the program, and click \u201cgenerate\u201d in a KeyGen window, a small tool that produces license keys. The guide claimed the build contained paid features such as 8 charts per tab and 400 price alerts and called the software \u201cfor educational purposes only.\u201d<\/p>\n However, earlier today, SlowMist issued<\/a> an alert saying the sample was an infostealer that collects browser login details and cryptocurrency wallet data as well as Telegram information before sending it to a command-and-control server through Windows\u2019 WinINet interface.<\/p>\n While Cryptotrice had described the project as open source and pointed users to a GitHub repository, SlowMist discovered that the download link in the promotional articles did not lead to GitHub. And when one follower asked why the repository and Discord were only accessible through the local application, the promoter claimed that the repository had gone private and that links in the app expired after one use.<\/p>\n According to SlowMist, the malware uses Telegram and Steam to retrieve and rotate its command-and-control servers, with the download site, arche-hypnose[.]com, appearing to be an actual legitimate website that had been compromised to distribute the malicious file.<\/p>\n The security company said that even though it obtained and analyzed the Windows version of the product, the macOS link at the time of writing was returning a 404 error, meaning it couldn\u2019t get any sample and could therefore not confirm whether that version also had the same malware.<\/p>\n Interestingly, when someone in the replies in one of the posts pushing the cracked TradingView Premium download asked Grok if it was safe, Cryptotrice responded, saying it was actually safer than the official TradingView \u201cbecause absolutely no credentials (email, passwords, etc.) ever leave your system.\u201d<\/p>\n For anyone who may have run the program, SlowMist says they should disconnect the affected machine from the network and move their assets to a clean device with a new wallet and seed phrase. They must also change the passwords for exchanges they use, as well as those of their browsers, emails, and Telegram accounts, including ending any of the messaging platform\u2019s active sessions.<\/p>\n \u201cCracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don\u2019t install them,\u201d the firm warned.<\/p>\n Last week, SlowMist issued another warning<\/a> to iPhone users regarding DarkSword, an exploit it said was able to pull wallet files and recovery phrases from their mobile devices when they browsed compromised websites.<\/p>\n The post Security Firm Warns of Infostealer Posing as Cracked TradingView Premium<\/a> appeared first on CryptoPotato<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" Security firm SlowMist has said that a cracked version of TradingView Premium promoted on X since mid-October is actually a Windows malware designed to steal sensitive information. The lure was free access to paid charting features, with one of the posts pushing the free download passing more than 360,000 views. How the Fake Premium Software […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-249529","post","type-post","status-publish","format-standard","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/249529"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=249529"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/249529\/revisions"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=249529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=249529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=249529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What You Need to Do if You May Have Run the Program<\/h2>\n