SlowMist Confirms So-Called "Cracked TradingView Premium" Is an Infostealer Trojan

Odaily reports: According to SlowMist monitoring, regarding the so-called "reverse-engineered cracked version of TradingView Premium" promoted in a post by X account @cryptotrice, the SlowMist security team conducted follow-up analysis and confirmed that the Windows sample is an infostealer trojan capable of harvesting browser credentials, crypto wallets, and Telegram data, and exfiltrating data to a C2 server via WinINet. The trojan leverages Telegram and Steam to dynamically obtain and rotate C2 download sites. arche-hypnose[.]com is suspected to be a legitimate website that was compromised and used to distribute the trojan. The macOS link currently returns a 404, and SlowMist has not yet obtained a sample. SlowMist warns that users who have run this software should immediately disconnect from the internet, use a clean device to transfer assets, and change their seed phrases.