Back Kucoin

Security Alert: The 'TradingView Premium Cracked Version' Spreads Malware—Users ...

Kucoin • November 8, 2026

BlockBeats report: On November 8, according to a prior security report by Malwarebytes, attackers distributed the Lumma info-stealing trojan to Windows users and Atomic Stealer (AMOS) to Mac users by posing as a "cracked version of TradingView Premium," stealing personal data and cryptocurrency wallet information, with victims reporting that their wallets had been emptied.

The security firm Hexastrike also documented similar attacks in its 2026 report, with the Windows payload being Vidar and the Mac payload remaining AMOS. Attackers used password-protected archives to hinder automated scanning and tricked users into installing the malware through deceptive claims such as "free" and "lifetime premium unlock."

Recent promotional posts on Platform X have required users to download password-protected compressed files, run KeyGen, and claimed that VirusTotal scan results are updated daily on GitHub. Users in the section have reported antivirus alerts, but the available materials are currently insufficient to confirm the specific malware type contained in the installation package offered by this post.

TradingView previously warned users not to download so-called "cracked," "developer," or "hacked" versions. The official desktop and mobile apps are available only through the official website and official app stores. Downloads promising free access to Premium may contain malware designed to steal your data.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake TradingView Premium Cracked Version Spreads Infostealer Malware Security firm SlowMist has identified a malicious campaign promoting a fake 'cracked' version of TradingView Premium, which has been active since mid-October 2026. The malware, disguised as legitimate software, is designed to steal sensitive user data, including cryptocurrency wallet information and Telegram credentials. The campaign, linked to an X account named 'cryptotrice', has garnered over 300,000 views. Users are tricked into downloading a password-protected archive that contains the infostealer, which can drain crypto wallets and capture browser logins. Other reports indicate that similar malware, like Lumma and Atomic Stealer, is also being distributed under the guise of cracked software. TradingView has repeatedly warned against downloading unofficial versions of its software, emphasizing that it does not offer cracked versions. Security experts recommend users avoid such downloads to protect their assets. 4 sources 68

Extracted Entities

Security Alert: The 'TradingView Premium Cracked Version' Spreads Malware—Users ...

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)

Tools (1)