SlowMist: Software Masquerading as a Cracked Version of TradingView Steals Wallet Data

On November 9, SlowMist disclosed that the X account cryptotrice has repeatedly promoted so-called cracked versions of TradingView Premium since mid-October. Following analysis, SlowMist confirmed that its Windows samples are infostealer malware capable of harvesting browser credentials, cryptocurrency wallets, and Telegram data, which are then exfiltrated to command-and-control servers.

The software instructs users to download a password-protected zip archive and generate a license code via a KeyGen. SlowMist stated that the malware utilizes Telegram and Steam to dynamically fetch and rotate its command-and-control servers; the macOS download link currently returns a 404 status, and no sample has been obtained yet.

SlowMist advises users who have executed the software to immediately go offline, transfer their assets to a new wallet on a clean device, change passwords for associated accounts, and terminate active Telegram sessions.