Security Alert: So-called "TradingView Premium cracked versions" pose a risk of data theft; do not download or run unknown installation packages.

November 8 — According to a previously released security report by Malwarebytes, attackers once used "TradingView Premium cracked version" as bait to spread the Lumma infostealer trojan to Windows users and Atomic Stealer (AMOS) to Mac users, stealing personal data and crypto wallet information, with some victims reporting their wallets were emptied.

A 2026 report by security firm Hexastrike also documented similar attacks, with the Windows payload being Vidar and the Mac payload still AMOS. Attackers used password-protected archives to hinder automated scanning and lured users into installing via claims such as free, lifetime unlocked Premium.

Recently, similar promotional posts on X have asked users to download password-protected archives, run a KeyGen, and claimed that VirusTotal scan results are updated daily on GitHub. Users in the comments reported antivirus alerts, but the available materials are not yet sufficient to confirm the specific trojan type in the installer provided by that post.

TradingView officially reminded users earlier not to download so-called "cracked versions," "developer versions," or "hacked versions." The official desktop and mobile apps are provided only through the official website and official app stores, and downloads promising free use of Premium may contain data-stealing malware.