Hunt: "cracked TradingView Premium" keygen download is a Windows infostealer that rotates C2 through Telegram and Steam
- Download URLs (defanged):
hxxps://www[.]arche-hypnose[.]com/get/(Windows),hxxps://www[.]arche-hypnose[.]com/mac/(macOS, 404 at analysis). - C2:
hxxps://xn[.]amanlay[.]org/rn/gate,hxxps://z[.]dak69[.]org/j/gate,hxxps://xn[.]amanlay[.]org/kw/gate. - Hunt for: DNS or proxy hits on those domains; password-protected archives followed by a keygen executable in user download folders; non-browser processes reading browser credential stores or Telegram
tdata; Steam community profile or Telegram channel lookups from processes that are not Steam or Telegram. - If it ran: SlowMist advises disconnecting, moving funds to a new wallet and seed phrase from a clean device, changing browser, exchange, email and Telegram passwords, and ending all Telegram sessions.
Sources: SlowMist TI alert on X (Nov 9)