SlowMist: Software disguised as cracked version of TradingView steals wallet data
Original headline慢雾：伪装成 TradingView 破解版本的软件窃取钱包数据
Not investment advice. Muhabbit scores how much a story may matter, not which way to trade.
SlowMist reported that the "TradingView Premium cracked version" promoted since mid-October by X account cryptotrice is actually info-stealing malware; its Windows sample harvests browser credentials, crypto wallet data and Telegram sessions and exfiltrates them to a command-and-control server. The download arrives as a password-protected archive with a KeyGen-generated license code, and the malware rotates its C2 servers via Telegram and Steam. The macOS download link currently returns a 404, so no Mac sample has been analyzed yet. SlowMist advises affected users to disconnect from the internet, move assets to a new wallet on a clean device, change passwords and terminate active Telegram sessions.
Muhabbit's AI wrote this summary in its own words from TechFlow's report and translated it from Chinese. It can get details wrong, so check the source.
Named in this story
SlowMist, TradingView, cryptotrice, Telegram, Steam