Scammers are posting links to what they describe as “TradingView Premium Cracked” for Windows or Mac and sharing the links on Reddit. According to Malwarebytes, the files contain malware that targets crypto wallets and drains tokens. The scammers claim that the cracked version of TradingView allows access to restricted features, an enticing lure for crypto investors who often enjoy browsing the charts and accessing advanced indicators. The scammers claim that the cracked software was sourced directly from the original files but contains two malware programs, Lumma and Atomic. Lumma, a project started in 2022, targets crypto wallets, features two-factor authentication, and focuses on information stealing. Atomic, a project discovered in 2023, is a malware package that has been roaming around in the wild for who knows when. It is notorious for uncovering administrative passwords and credentials. The cracked file is double-zipped, with the second zip containing a password. This should already be a red flag because there is no need to double-zip the file unless one is hiding something from an automated scanner. The installer is a popular malware package called AMOS (Atomic Stealer) with the Mac version. The installer checks whether it is in a sandbox to avoid detection by malware researchers. AMOS then proceeds to steal sensitive data after checking whether there is a sandbox. It sends the package via a POST request to a server located in Seychelles at the address 45.140.13.x. The malware files are hosted on a Dubai-based cleaning company’s website, suggesting the attackers have taken control of the site, given that they could have picked another server for their files. The website has an out-of-date PHP version, 7.3.33, which became vulnerable in December 2021, providing the attackers with an easy target to host their files and launch a malware campaign against cryptocurrency holders. The Windows version extracts information using a BAT file, costs.tiff.bat. It assembles an executable from numerous file fragments, obfuscates automatic virus scanner attacks, and communicates with a command and control centre at cousidporke dot icu, a domain registered in Russia just a week ago. The scammers post the malware links on Reddit and then stick around to help people install the software. Many attack victims may feel more secure due to the constant support offered on Reddit. This seems to be a very dedicated campaign to spread the malware. However, since the target is a cryptocurrency wallet, the effort seems worth it because the attackers are potentially making millions of dollars in stolen funds.
