SlowMist: "Cracked TradingView Premium" Confirmed to Be an Information-Stealing Trojan

We Nov 9 news: In response to the so-called "reverse-engineered cracked version of TradingView Premium" promoted in a post by X account @cryptotrice, the SlowMist security team followed up with an analysis and confirmed that the Windows sample is an information-stealing trojan:

• It contains collection logic for browser credentials, crypto wallets and Telegram data, and sends data back to the C2 via WinINet
• It uses Telegram and Steam to dynamically obtain and rotate C2
• The download site arche-hypnose[.]com is suspected to be a legitimate website that was compromised and used to distribute the trojan
• The macOS link is currently 404, so no sample has been obtained yet

SlowMist warns that users who have already run this software should immediately disconnect from the network, use a clean device to move assets and change their seed phrase, change the passwords of their browser, exchange, email and Telegram accounts, and clear active Telegram sessions. Cracked software, KeyGens and password-protected compressed archives are the most common distribution methods for information-stealing trojans — do not install them.

Previous news: a "TradingView Premium cracked version" promoted by a certain X account is suspected to be information-stealing malware.