Security firm SlowMist has warned that a cracked version of TradingView Premium promoted on X since mid-October is actually Windows malware designed to steal sensitive information. The lure was free access to paid charting features, and one post pushing the free download passed more than 360,000 views.
How the fake premium software works
An account identifying itself as an on-chain developer under the name Cryptotrice repeatedly promoted a guide to what it called a reverse-engineered TradingView Premium build, version 3.3.0, released in October. The posts asked users to download a password-protected archive, run the program, and click “generate” in a KeyGen window, a small tool that produces license keys. The guide claimed the build contained paid features such as 8 charts per tab and 400 price alerts, and described the software as “for educational purposes only.”
SlowMist issued an alert saying the sample was an infostealer that collects browser login details, cryptocurrency wallet data, and Telegram information before sending it to a command-and-control server through Windows’ WinINet interface.
While Cryptotrice described the project as open source and pointed users to a GitHub repository, SlowMist found that the download link in the promotional articles did not lead to GitHub. When a follower asked why the repository and Discord were only accessible through the local application, the promoter claimed the repository had gone private and that links in the app expired after one use.
According to SlowMist, the malware uses Telegram and Steam to retrieve and rotate its command-and-control servers. The download site, arche-hypnose[.]com, appeared to be a legitimate website that had been compromised to distribute the malicious file.
SlowMist said it obtained and analyzed the Windows version of the product, but the macOS link at the time of writing returned a 404 error, so it could not obtain a sample and could not confirm whether that version also carried the same malware.
In one reply thread, when someone asked Grok whether the cracked download was safe, Cryptotrice responded that it was safer than the official TradingView “because absolutely no credentials (email, passwords, etc.) ever leave your system.”
What to do if you may have run the program
For anyone who may have run the program, SlowMist advised disconnecting the affected machine from the network and moving assets to a clean device with a new wallet and seed phrase. Users should also change passwords for exchanges, browsers, emails, and Telegram accounts, including ending any active Telegram sessions.
“Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them,” the firm warned.
Last week, SlowMist issued another warning to iPhone users regarding DarkSword, an exploit it said was able to pull wallet files and recovery phrases from mobile devices when users browsed compromised websites.
