SlowMist: Windows infostealer disguised as TradingView Premium

The Windows sample was an infostealer

SlowMist identified the Windows sample distributed through a purported cracked TradingView Premium build as an infostealer, according to the security firm’s alert. The malware collects browser login details, cryptocurrency wallet data and Telegram information before sending the data to a command-and-control server through the Windows WinINet interface.

Inside the download chain

Promotional posts directed users to download a password-protected archive, run the program and click “generate” in a KeyGen window, a small tool that produces license keys. The guide claimed the build included paid features such as 8 charts per tab and 400 price alerts, and described the software as being for educational purposes only.

Cryptotrice, the promoter behind the posts, described the project as open source and pointed users to a GitHub repository. SlowMist found that the download link in the promotional articles did not lead to GitHub. When a follower asked why the repository and Discord were accessible only through the local application, the promoter said the repository had gone private and that links inside the app expired after one use.

The practical distinction is between the claimed source repository and the actual delivery mechanism: promotional links did not lead to GitHub, while the executable came through a download site that appears to have been compromised. A one-use link offers no corresponding way to inspect the code before running it.

SlowMist said the malware uses Telegram and Steam to retrieve and rotate its command-and-control servers. The download site, arche-hypnose[.]com, appeared to be a legitimate website compromised to distribute the malicious file.

What should traders who ran the program do now?

SlowMist says anyone who may have run the program should disconnect the affected machine from the network. Assets should move to a clean device with a new wallet and seed phrase. Passwords for exchanges, browsers, email and Telegram accounts must change, and active Telegram sessions should end.

The recommended sequence starts with isolation, followed by asset transfers and credential rotation. SlowMist warned: “Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them.”

A safety claim contradicted the observed code

In one promotional post, a user asked Grok whether the download was safe. Cryptotrice answered that it was safer than the official TradingView because “absolutely no credentials (email, passwords, etc.) ever leave your system.”

SlowMist’s analysis describes a program designed to collect those credentials and transmit them to a command-and-control server. The assurance therefore conflicts with the behavior the security firm documented, regardless of the features advertised in the promotional guide.

A separate iPhone warning

Last week, SlowMist warned iPhone users about DarkSword, an exploit it said could pull wallet files and recovery phrases from mobile devices when users browsed compromised websites. That advisory covers a different delivery method from the Windows archive: visiting a compromised site rather than running a downloaded program. The two alerts nevertheless share a concern with locally exposed wallet credentials.

The next verification point is macOS

SlowMist obtained and analyzed the Windows version, but the macOS link was returning a 404 error at the time of writing. The firm could not obtain a macOS sample and could not confirm whether that version also contained the same malware. The failed link leaves an unresolved platform gap, not evidence that the macOS build was safe.

Until SlowMist can analyze a live macOS sample, that build’s infection status remains unresolved. For anyone who ran the Windows archive, the remediation window begins with immediate network disconnection, before assets or credentials are handled on the affected machine.