From CryptoPotato · By Wayne Jones
Security firm SlowMist has said that a cracked version of TradingView Premium promoted on X since mid-October is actually a Windows malware designed to steal sensitive information.
The lure was free access to paid charting features, with one of the posts pushing the free download passing more than 360,000 views.
How the Fake Premium Software Works
Cryptotrice, who identifies themselves on X as an on-chain dev, has been repeatedly promoting a guide to what they call a reverse-engineered TradingView Premium build, version 3.3.0, released in October.
In the posts, they asked users to download a password-protected archive, run the program, and click “generate” in a KeyGen window, a small tool that produces license keys. The guide claimed the build contained paid features such as 8 charts per tab and 400 price alerts and called the software “for educational purposes only.”
However, earlier today, SlowMist issued an alert saying the sample was an infostealer that collects browser login details and cryptocurrency wallet data as well as Telegram information before sending it to a command-and-control server through Windows’ WinINet interface.
While Cryptotrice had described the project as open source and pointed users to a GitHub repository, SlowMist discovered that the download link in the promotional articles did not lead to GitHub. And when one follower asked why the repository and Discord were only accessible through the local application, the promoter claimed that the repository had gone private and that links in the app expired after one use.
According to SlowMist, the malware uses Telegram and Steam to retrieve and rotate its command-and-control servers, with the download site, arche-hypnose[.]com, appearing to be an actual legitimate website that had been compromised to distribute the malicious file.
The security company said that even though it obtained and analyzed the Windows version of the product, the macOS link at the time of writing was returning a 404 error, meaning it couldn’t get any sample and could therefore not confirm whether that version also had the same malware.
Interestingly, when someone in the replies in one of the posts pushing the cracked TradingView Premium download asked Grok if it was safe, Cryptotrice responded, saying it was actually safer than the official TradingView “because absolutely no credentials (email, passwords, etc.) ever leave your system.”
What You Need to Do if You May Have Run the Program
For anyone who may have run the program, SlowMist says they should disconnect the affected machine from the network and move their assets to a clean device with a new wallet and seed phrase. They must also change the passwords for exchanges they use, as well as those of their browsers, emails, and Telegram accounts, including ending any of the messaging platform’s active sessions.