ZyCrypto 2025-03-21 13:46:58

“TradingView Premium Cracked” Malware Targets Crypto Wallets on Windows and Mac

Scammers are posting links to what they describe as “TradingView Premium Cracked” for Windows or Mac and sharing the links on Reddit. According to Malwarebytes, the files contain malware that targets crypto wallets and drains tokens. The scammers claim that the cracked version of TradingView allows access to restricted features, an enticing lure for crypto investors who often enjoy browsing the charts and accessing advanced indicators. The scammers claim that the cracked software was sourced directly from the original files but contains two malware programs, Lumma and Atomic. Lumma, a project started in 2022, targets crypto wallets, features two-factor authentication, and focuses on information stealing. Atomic, a project discovered in 2023, is a malware package that has been roaming around in the wild for who knows when. It is notorious for uncovering administrative passwords and credentials. The cracked file is double-zipped, with the second zip containing a password. This should already be a red flag because there is no need to double-zip the file unless one is hiding something from an automated scanner. The installer is a popular malware package called AMOS (Atomic Stealer) with the Mac version. The installer checks whether it is in a sandbox to avoid detection by malware researchers. AMOS then proceeds to steal sensitive data after checking whether there is a sandbox. It sends the package via a POST request to a server located in Seychelles at the address 45.140.13.x. The malware files are hosted on a Dubai-based cleaning company’s website, suggesting the attackers have taken control of the site, given that they could have picked another server for their files. The website has an out-of-date PHP version, 7.3.33, which became vulnerable in December 2021, providing the attackers with an easy target to host their files and launch a malware campaign against cryptocurrency holders. The Windows version extracts information using a BAT file, costs.tiff.bat. It assembles an executable from numerous file fragments, obfuscates automatic virus scanner attacks, and communicates with a command and control centre at cousidporke dot icu, a domain registered in Russia just a week ago. The scammers post the malware links on Reddit and then stick around to help people install the software. Many attack victims may feel more secure due to the constant support offered on Reddit. This seems to be a very dedicated campaign to spread the malware. However, since the target is a cryptocurrency wallet, the effort seems worth it because the attackers are potentially making millions of dollars in stolen funds.

Наиболее читаемые новости

Bitcoin Open Interest Falls To $37 Billion—Do...
2025-03-21
Mysterious $940K DUCK Token Withdrawal from O...
2025-03-21
How Many Dogecoin Millionaires Are Out There?...
2025-03-21
Crypto Biz: As crypto booms, recession looms
2025-03-21
Concerns Rise Over XRP’s Network Utility Amid...
2025-03-21
China urges expansion of digital yuan usage b...
2025-03-21
Free Cloud Mining to Earn Bitcoin: Top 7 Clou...
2025-03-21
CZ’s Cartoon Double Goes Viral: Binance Found...
2025-03-21

Связанные новости

Прочтите Отказ от ответственности : Весь контент, представленный на нашем сайте, гиперссылки, связанные приложения, форумы, блоги, учетные записи социальных сетей и другие платформы («Сайт») предназначен только для вашей общей информации, приобретенной у сторонних источников. Мы не предоставляем никаких гарантий в отношении нашего контента, включая, но не ограничиваясь, точность и обновление. Никакая часть содержания, которое мы предоставляем, представляет собой финансовый совет, юридическую консультацию или любую другую форму совета, предназначенную для вашей конкретной опоры для любых целей. Любое использование или доверие к нашему контенту осуществляется исключительно на свой страх и риск. Вы должны провести собственное исследование, просмотреть, проанализировать и проверить наш контент, прежде чем полагаться на них. Торговля - очень рискованная деятельность, которая может привести к серьезным потерям, поэтому проконсультируйтесь с вашим финансовым консультантом, прежде чем принимать какие-либо решения. Никакое содержание на нашем Сайте не предназначено для запроса или предложения