SlowMist: Software Disguised as a Cracked TradingView Version Steals Wallet Data

As reported by TechFlow on November 9, SlowMist disclosed that X account cryptotrice has repeatedly promoted so-called cracked versions of TradingView Premium since mid-October. SlowMist's analysis confirmed that the Windows sample is an infostealer capable of collecting browser credentials, crypto wallets, and Telegram data and sending them to a command-and-control server.

The software requires users to download a password-protected archive and generate a license code via KeyGen. SlowMist said the malware uses Telegram and Steam to dynamically obtain and rotate command-and-control servers; the macOS download link currently returns 404, and no sample has been obtained yet.

SlowMist advises users who have run the software to immediately disconnect from the internet, transfer assets to new wallets on clean devices, change passwords for related accounts, and terminate active Telegram sessions.

Source: TechFlow