Malware Disguised as TradingView Premium Steals Crypto Wallet Data
Pirated charting software collects browser data and crypto access from Windows PCs.
A modified version of TradingView Premium has been circulating on social media since mid-October. The file promises free access to paid features but functions as malicious software designed to steal sensitive data.
Security firm SlowMist identified that the software collects information from browsers and cryptocurrency wallet data. The program also captures Telegram logs before sending all content to remote servers controlled by criminals.
The attack uses a command server rotation technique via Telegram and Steam. The website used to distribute the malicious file appears to be a legitimate page that was compromised to host the infected installer.
Promoters of the software claimed the code was open source and safe to use. However, the links to official repositories did not work and the explanations regarding the lack of access to the source code were inconsistent.
The technical recommendation for anyone who ran the file is to disconnect the machine from the network immediately. The security firm has not yet confirmed if the version intended for the macOS system exhibits the same malicious behavior.
Spotted an error? Write to suporte@criptoico.com.br.
