Security firm SlowMist has warned that an X account is distributing crypto-stealing malware through a fake “cracked” version of TradingView Premium. According to the firm, this type of scam has been running for about 18 months and is designed to steal private keys, browser logins and messaging sessions. “Cracked” software is an unauthorized copy of a paid product with its licensing checks stripped out — a lure that has recurred across multiple malware campaigns documented by security researchers.

In a warning posted on its official X account (SlowMist on X), SlowMist said an account using the handle “cryptotrice” has been spreading the fake “cracked” software since mid-October. The package carries an infostealer — malware built to sweep credentials, session data and wallet material from an infected device — that can drain crypto wallets and take over Telegram accounts.

A familiar playbook

TradingView, the charting website traders use to view charts and study the market, has cautioned users about “cracked version” scams for more than a year and has clarified that it does not sell cracked copies of its software. In 2025, the company reported that scammers had set up fake YouTube channels impersonating its official account (TradingView blog).

The channels steered unsuspecting viewers toward a “developer version” or “cracked version” of the TradingView app. The “download” option for the so-called developer version was in reality a PowerShell command that installed a remote access trojan and then emptied victims’ wallets. TradingView has stated that it never asks users to run command-line scripts to install its software.

From fake ads to fake AI tools

Prior to SlowMist’s warning, Bitdefender tracked a long-running advertising campaign marketing a fake “TradingView Premium” (Bitdefender Labs). The campaign started on Facebook Ads and later spread to Google Ads and YouTube. By 2026, the same groups had moved on from “free premium” offers and were instead selling fake AI tools. The pitch changed, but the files researchers pulled from these campaigns still delivered data-stealing malware.

Malwarebytes uncovered a site called TradingClaw that claimed to be an AI helper for TradingView (Malwarebytes). The tool actually installed Needle Stealer, a data-stealing program written in the Go programming language. HP (NYSE: HPQ) separately found a fake AI crypto trading tool at tradingclaw[.]pro that hid Needle Stealer inside a program signed by Microsoft (NASDAQ: MSFT). The signature helped it slip past Windows SmartScreen, the built-in Windows security check. Code signatures are meant to confirm a program’s publisher to the operating system, so a file bearing a valid one typically draws fewer security warnings. Once inside a system, the malware replaced the victim’s browser wallet extension with a harmful copy.

Needle Stealer harvests browser history, cookies and saved logins, and pulls data from applications such as Telegram. It goes after desktop wallets like Ledger, Trezor and Exodus, and browser wallets like MetaMask and Coinbase Wallet (Coinbase, NASDAQ: COIN), in an attempt to steal seed phrases — the recovery word sequences that can recreate a wallet on another device and give whoever holds them full control of its funds. The sample HP analyzed looked for seven browser wallet extensions, including Phantom, and captured any password the victim typed into a fake unlock screen.

Infostealer infections climbing

Cryptopolitan has previously reported on Reaper, a Mac data-stealing program hidden behind fake app download pages that went after Ledger Live, Trezor Suite and Exodus once active (Cryptopolitan).

Flashpoint reported that 7.4 million devices were infected with infostealers in the first half of 2026, 27% more than in the previous six months, and that 1.7 billion credentials have been stolen. Because infostealers sweep up whatever a browser has saved, that credential theft reaches beyond crypto accounts to any login a victim stored. Flashpoint ranked Vidar ahead of StealC and Lumma as the most common malware variants. Lumma had been in the lead until a May 2025 law-enforcement takedown seized about 2,300 command-and-control domains. Flashpoint also noted that Telegram has become a channel for spreading this kind of tool — the same app Needle Stealer is built to loot. The platform now sits on both sides of the threat: a distribution channel for stealers and a prize they harvest once inside.