Security Firm Warns of Infostealer Posing as Cracked TradingView Premium
Key Summary
Blockchain security firm SlowMist warned traders Tuesday about a Windows infostealer masquerading as cracked TradingView software. Meanwhile, threat intelligence reports revealed that the DarkSword exploit kit drained $5.57M from digital asset holders across compromised web domains without requiring transaction approvals.
Key Bullets
- SlowMist identified a Windows infostealer disguised as cracked TradingView software distributing malicious payloads across social media channels.
- Threat intelligence reports confirmed that $5.57M in digital assets was drained through exploit kits targeting unsuspecting retail traders.
- The DarkSword exploit kit was offered online for $30,000 across eighteen malicious web domains targeting browser vulnerabilities.
- Affected users must disconnect infected hardware from local networks and generate fresh seed phrases on isolated devices immediately.
Malicious Software Spreads Via Social Media
Blockchain security firm SlowMist issued an urgent warning Tuesday after identifying a Windows infostealer masquerading as a cracked build of TradingView Premium version 3.3. 0. Promotional posts distributed on X since mid-October successfully lured traders by promising free access to advanced charting features. One primary promotional post accumulated more than 360,000 views before security researchers flagged the payload.
An on-chain account operating under the pseudonym Cryptotrice spearheaded the distribution campaign. The promoter directed unsuspecting users to download password-protected archives containing a fake license key generator. The malicious application subsequently siphons browser login credentials, Telegram sessions, and local cryptocurrency wallet files directly to remote command-and-control servers.
Infrastructure and Evasion Tactics Exposed
SlowMist analysis revealed that download links systematically bypassed stated GitHub repositories to deliver payloads from compromised domains. The malware relies on Steam and Telegram infrastructure to dynamically update and rotate command-and-control server addresses. Meanwhile, macOS deployment links returned 404 errors during testing, leaving Apple device vulnerabilities unconfirmed.
When questioned by community members regarding potential security risks, the promoter claimed the software operated entirely locally without transmitting credentials. SlowMist discredited those assurances immediately. Traders were left scrambling to secure exposed accounts against escalating automated threats.
Threat intelligence tracking by researcher Officer's Notes revealed that $5.57M in digital assets had already been drained through related mobile and desktop exploit vectors. Investigators discovered that the DarkSword exploit kit was being offered online for $30,000 across eighteen malicious web domains. Security alerts noted that compromised websites harvest wallet files without requiring explicit transaction approvals.
Immediate Remediation Steps Required Now
SlowMist published strict mitigation protocols for any users who executed the unauthorized software. Affected individuals must disconnect infected hardware from local networks instantly. Users need to generate fresh seed phrases on isolated devices and transfer all remaining digital assets.
Exchanges, email providers, and messaging applications require immediate password resets alongside the termination of active session tokens. Cracks remain the primary attack vector for asset loss. Binance co-founder Changpeng Zhao urged iPhone users via a social media post to install operating system updates immediately to counter ongoing zero-click browser exploitation campaigns.
Impact score:4 out of 5 | Narrative Tracker:Security, Exploits & Asset Recovery
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.