Blockchain security firm SlowMist has issued a warning regarding a malicious Windows installer disguised as a cracked version of TradingView Premium. Promoted on the social media platform X since mid-October, the fake software lures users with promises of free access to paid charting features. One of the promotional posts for the unauthorized build surpassed 360,000 views.
The malicious campaign was pushed by an on-chain developer identifying as Cryptotrice, who shared a guide for a reverse-engineered build labeled version 3.3.0. Users were instructed to download a password-protected archive, run the program, and use a KeyGen window to generate license keys. SlowMist discovered that the actual download links did not direct users to the GitHub repository cited in the promotional material, but instead led to a compromised legitimate website, arche-hypnose[.]com.
According to SlowMist's analysis, the program functions as an infostealer. Once executed on a Windows machine, the malware harvests browser login details, cryptocurrency wallet data, and Telegram information, transmitting the stolen data to remote command-and-control servers using Windows' WinINet interface. The malware relies on Telegram and Steam to manage and rotate its servers.
SlowMist advises anyone who has executed the program to immediately disconnect the affected device from the network and transfer their assets to a clean machine using a new wallet and seed phrase. Affected individuals are also urged to update passwords across all browser accounts, email addresses, and cryptocurrency exchanges, as well as terminate active Telegram sessions. The security firm reiterated its warning against downloading cracked software, KeyGens, and password-protected archives.