---
title: Hunt: "cracked TradingView Premium" keygen download is a Windows infostealer that rotates C2 through Telegram and Steam | ctxsec
url: https://ctxsec.com/items/hunt-slowmist-cracked-tradingview-premium-infostealer-iocs
description: "SlowMist says an X account has promoted a \"reverse-engineered cracked TradingView Premium\" since mid-October, some posts passing 300K views. The password-protected download plus keygen is an infostealer that takes browser credentials, crypto wallet data and Telegram data and sends them to C2 over WinINet, using Telegram and Steam to fetch and rotate C2 addresses. The download site appears to be a compromised legitimate site."
status: "security-vendor analysis (SlowMist TI alert, Nov 9) with IOCs; Windows sample confirmed as infostealer, macOS sample not obtained"
published: 2026-11-09
---

> SlowMist says an X account has promoted a "reverse-engineered cracked TradingView Premium" since mid-October, some posts passing 300K views. The password-protected download plus keygen is an infostealer that takes browser credentials, crypto wallet data and Telegram data and sends them to C2 over WinINet, using Telegram and Steam to fetch and rotate C2 addresses. The download site appears to be a compromised legitimate site.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-slowmist-cracked-tradingview-premium-infostealer-iocs.md)

security-vendor analysis (SlowMist TI alert, Nov 9) with IOCs; Windows sample confirmed as infostealer, macOS sample not obtained

2026-11-09

### Hunt: "cracked TradingView Premium" keygen download is a Windows infostealer that rotates C2 through Telegram and Steam

- **Download URLs (defanged):** `hxxps://www[.]arche-hypnose[.]com/get/` (Windows), `hxxps://www[.]arche-hypnose[.]com/mac/` (macOS, 404 at analysis).
- **C2:** `hxxps://xn[.]amanlay[.]org/rn/gate`, `hxxps://z[.]dak69[.]org/j/gate`, `hxxps://xn[.]amanlay[.]org/kw/gate`.
- **Hunt for:** DNS or proxy hits on those domains; password-protected archives followed by a keygen executable in user download folders; non-browser processes reading browser credential stores or Telegram `tdata`; Steam community profile or Telegram channel lookups from processes that are not Steam or Telegram.
- **If it ran:** SlowMist advises disconnecting, moving funds to a new wallet and seed phrase from a clean device, changing browser, exchange, email and Telegram passwords, and ending all Telegram sessions.

Sources: [SlowMist TI alert on X (Nov 9)](https://x.com/SlowMist_Team/status/2119643046489051354)