What SlowMist found
SlowMist says a Windows program advertised on X as a cracked version of TradingView Premium is actually an infostealer. The blockchain security firm analyzed the sample and confirmed it collects browser credentials, crypto wallet data and Telegram data. It then sends that information to servers controlled by attackers, according to the alert. The malware also uses Telegram and Steam, SlowMist said, to locate and switch between those servers. That detail suggests the operators want some resilience if one server goes down. I think that is one reason the warning matters: the tool is not just a bad download, it is built to keep working.
The alert did not document a confirmed theft or give a victim count. SlowMist also said the advertised macOS download returned a 404 error, so it did not get a sample for that operating system. The Windows finding is the part with a technical review behind it.
How the campaign spread
SlowMist tied the promotion to the X account @cryptotrice. The account had pushed the purported reverse-engineered software since mid-October, and some posts passed 300,000 views. An Oct. 17 guide claims to bypass TradingView’s license checks. It tells users to extract a password-protected archive, run a desktop program and generate a license code through a KeyGen. The guide points to purported GitHub and Discord links inside the app. In a Nov. 6 reply, the account said the repository was private and could be reached only through the apps.
The download links in the guide go to halchemicals[.]com, not GitHub. SlowMist separately named arche-hypnose[.]com as a download site and said it looked like a legitimate website that had been compromised to spread the malware. TradingView, the charting platform, provides its legitimate desktop downloads through its own website.
What exposed users should do
Anyone who already ran the software should disconnect the affected device from the network right away, SlowMist advised. It recommended moving assets with a clean device to a new wallet that uses a new seed phrase. Users should also change browser, exchange, email and Telegram passwords, and end active Telegram sessions. Perhaps the hardest part is speed. If wallet data or session tokens are already exposed, waiting gives attackers more time to act.
