SlowMist Flags Cracked TradingView Premium as Infostealer

BitcoinWorldSlowMist Flags Cracked TradingView Premium as Infostealer

SlowMist has confirmed that a build billed as a cracked TradingView Premium, promoted on X since mid-October, is a Windows information-stealing trojan, Cryptopotato reported. The security firm said one promotional post pushing the free download drew more than 360,000 views. The build was circulated by an X account called Cryptotrice, which described itself as an on-chain developer and framed the software as a reverse-engineered TradingView Premium version 3.3.0.

SlowMist’s analysis found the Windows sample collects browser credentials, crypto wallet data and Telegram information, then sends it to a command-and-control server through Windows’ WinINet interface. The macOS link was returning a 404, so the firm could not test whether that version is also malicious.

Key facts

• SlowMist identified the Windows sample as an infostealer that gathers browser logins, cryptocurrency wallet data and Telegram information.
• The malware uses Telegram and Steam to retrieve and rotate its command-and-control servers.
• The download site arche-hypnose[.]com appears to be a legitimate website that was compromised to distribute the file.
• SlowMist said the macOS link was returning a 404 at the time of analysis, so it could not obtain a sample or confirm whether that version is also infected.
• The build was pitched with paid features such as eight charts per tab and 400 price alerts, under a “for educational purposes only” framing.

How the fake build was pitched

Cryptotrice’s posts directed users to a password-protected archive and told them to run the program and click “generate” in a KeyGen window, a small tool that produces license keys. While the promoter described the project as open source and pointed to a GitHub repository, SlowMist found that the download link in the promotional articles did not lead to GitHub. When a follower asked why the repository and Discord were only reachable through the local application, the promoter said the repository had gone private and that in-app links expired after a single use.

In one reply, when someone asked Grok whether the download was safe, Cryptotrice argued it was safer than the official TradingView because, in its telling, no credentials such as email addresses or passwords ever leave the user’s system. SlowMist’s analysis contradicts that claim directly. According to PANews, which reported the follow-up analysis on November 9, the sample carries collection logic for browser credentials, crypto wallets and Telegram data and returns it to the C2 over WinINet.

What to do if you ran the program

SlowMist’s guidance for anyone who may have executed the installer is to disconnect the affected machine from the network and move assets to a clean device using a new wallet and seed phrase. Users should also change passwords for exchanges, browsers, email and Telegram, and end any active Telegram sessions. The firm told users flatly not to install cracked software, KeyGens or password-protected archives, describing them as among the most common distribution routes for infostealers.

The two accounts of the campaign align on the core technical findings. Neither outlet says how many machines were infected, and Cryptopotato notes only that SlowMist acquired and analysed the Windows version, leaving the macOS question open.

Why it matters

The campaign targets exactly the audience most exposed to irreversible losses: traders looking for paid charting features without paying, whose browsers and Telegram accounts often sit alongside exchange logins and wallet access. Because the payload returns data through a compromised legitimate domain rather than an obviously suspicious one, standard link-checking instincts are less likely to catch it. SlowMist’s earlier warnings this month followed the same pattern of researchers flagging distribution channels before broad damage reports emerged.

What to watch

The next signal is whether SlowMist or another firm obtains a macOS sample once that link is restored, and whether arche-hypnose[.]com’s operator confirms the compromise. Until then, the Windows finding is the confirmed part of the story.

This post SlowMist Flags Cracked TradingView Premium as Infostealer first appeared on BitcoinWorld.