Fake TradingView Premium package spreads wallet-stealing Windows malware

SlowMist has warned that an X account is using a fake “cracked” version of TradingView Premium to distribute cryptocurrency-stealing malware. The package presents itself as a way to unlock premium features without the usual purchase, but according to Cryptopolitan, the security firm found that it is actually a Windows infostealer. The campaign seeks to capture sensitive information that could provide direct access to users’ digital assets and accounts. TronWeekly reports that the promotion came from the account @cryptotrice and had reached more than 300,000 viewers. Its analysis describes malware that collects browser credentials, cryptocurrency wallet data and Telegram information. TronWeekly also reports that the stolen data is exfiltrated through WinINet, with communication directed to rotating command-and-control servers. Cryptopolitan adds private keys and messaging sessions to the potential targets identified by SlowMist. The three outlets broadly agree on the danger posed by the installer. Cryptopolitan, TronWeekly and CryptoPotato all connect the fake TradingView Premium download with a Windows infostealer that collects browser, wallet and messaging-related information and sends it to remote infrastructure. Their clearest differences are in the additional context each supplies: the roughly 18-month campaign duration appears only in Cryptopolitan’s summary, while the account name, audience figure and WinINet transfer mechanism come from TronWeekly. CryptoPotato emphasizes the sequence in which information is collected and then sent to remote servers. The broader crypto market was flat at the time of the warning, with total capitalization standing at $2.56 trillion. Bitcoin was down 0.58% over 24 hours, while the Fear & Greed index registered 32, placing sentiment in the “Fear” category. No cryptocurrency named in the reporting was directly tied to the incident, so the warning represents a security and wallet-protection issue rather than a token-specific market event. The significance lies in the combination of an attractive free-software lure and the sensitivity of the targeted material. Browser credentials, wallet data, private keys and Telegram sessions could all provide avenues for unauthorized access if the infostealer reaches a victim’s device. Follow-up attention will center on whether the promoting account and associated download infrastructure are removed, whether additional victims or related packages are identified, and whether SlowMist or other security researchers publish further technical findings.