Security research firm SlowMist has issued a warning about a malicious “cracked” version of TradingView Premium that is being promoted on the social platform X. The campaign, which began in mid‑October, uses the handle “cryptotrice” to distribute a PowerShell‑based installer that embeds the Needle Stealer infostealer, a program capable of draining crypto wallets and hijacking Telegram accounts.

How the fake premium is delivered

According to SlowMist, the fraudulent installer is advertised as a free or discounted upgrade to TradingView’s paid service. Victims are instructed to run a PowerShell command that appears to download the “developer version” of the platform. In reality, the script pulls down Needle Stealer, a Go‑written data‑stealing tool that can bypass Windows SmartScreen by using a Microsoft‑signed binary, as reported by Malwarebytes and HP.

Capabilities of Needle Stealer

The malware harvests browser history, cookies, saved logins, and seed phrases from popular desktop wallets such as Ledger, Trezor, and Exodus, as well as browser extensions including MetaMask, Coinbase Wallet, and Phantom. It also captures Telegram credentials and can replace legitimate wallet extensions with malicious copies. The program records any password entered on a fake unlock screen, giving attackers full control over the victim’s crypto assets.

Background and broader threat landscape

TradingView has warned users about “cracked” versions for more than a year, noting that the company never distributes such software. Earlier scams involved fake YouTube channels that redirected users to malicious downloads. A recent ad campaign tracked by Bitdefender moved from Facebook and Google ads to promoting fake AI tools, such as a site called TradingClaw that also bundled Needle Stealer. Flashpoint data shows that infostealer infections rose 27% in the first half of 2026, with 7.4 million devices compromised and 1.7 billion credentials stolen.

What to watch next

Security researchers expect the attackers to evolve the distribution chain, potentially leveraging more social platforms and deeper phishing campaigns. Users should monitor official TradingView communications, verify download sources, and employ hardware wallets with strong passphrase protection. SlowMist and other firms will likely continue tracking related malware variants as they adapt to new defensive measures.