SlowMist confirms that the so-called "cracked version of TradingView Premium" contains information-stealing trojans.

November 9th, according to SlowMist monitoring, in response to the so-called "reverse cracked version of TradingView Premium" promoted in a post by X account @cryptotrice, the SlowMist security team confirmed after follow-up analysis that the Windows sample is an information-stealing trojan with logic to collect browser credentials, crypto wallets, and Telegram data, and exfiltrate data to C2 via WinINet.

It is reported that the trojan uses Telegram and Steam dynamics to obtain and rotate C2 download sites. arche-hypnose[.]com is suspected to be a legitimate website that was compromised and used to distribute the trojan. The macOS link currently returns 404, and SlowMist has not yet obtained the sample. SlowMist reminds users who have run this software to immediately disconnect from the network, use a clean device to transfer assets, and change their mnemonic phrases.