SlowMist flags X account pushing fake TradingView crack that drains wallets

SlowMist says the handle has been pushing the bogus file since mid-October, bundling an infostealer that drains crypto wallets and seizes control of Telegram accounts. The firm says this flavor of scam has been running for about 18 months, with private keys, browser logins and messaging sessions as the prizes.

TradingView has warned about cracked-version traps for more than a year and insists it does not sell cracked software. In 2025 it called out fake YouTube channels posing as its official account, which steered viewers toward a supposed developer or cracked build. That download was really a PowerShell command that installed a remote access trojan and cleaned out wallets. TradingView says it never asks users to run command-line scripts to install anything.

Before SlowMist's alert, Bitdefender tracked a long-running ad campaign selling a fake TradingView Premium, starting on Facebook Ads and later spreading to Google Ads and YouTube. By 2026 the same crews had ditched free-premium bait for fake AI tools. Malwarebytes found TradingClaw, pitched as an AI helper for TradingView, which instead dropped Needle Stealer, a stealer written in Go.

HP found a fake AI crypto trading tool at tradingclaw[.]pro hiding Needle Stealer inside a program signed by Microsoft, letting it slip past Windows SmartScreen. Once inside, it swapped victims' browser wallet extensions for malicious copies. Needle Stealer grabs browser history, cookies and saved logins, pulls data out of Telegram, and hunts desktop wallets like Ledger, Trezor and Exodus plus browser wallets including MetaMask, Coinbase Wallet and Phantom. It also logged every password typed into a fake unlock screen.

The numbers behind the trend are ugly. Flashpoint reported 7.4 million devices infected with infostealers in the first half of 2026, up 27% on the previous six months, with 1.7 billion credentials stolen. It ranked Vidar as the most common variant, ahead of StealC and Lumma, which held the top spot until a May 2025 law-enforcement takedown seized roughly 2,300 command-and-control domains. Flashpoint noted Telegram has become a distribution channel for these tools, the same app Needle Stealer is built to loot.