A new malware campaign is abusing Reddit to distribute fake “cracked” builds of TradingView Premium that secretly install Vidar and AMOS information‑stealing malware on Windows and macOS systems.
The campaign targets users searching for free or pirated versions of TradingView Premium, a popular browser‑based charting and social platform for stock, crypto, and forex traders.
Threat actors post in small or newly created subreddits such as r/BitBullito, r/CryptoCurrencyDM, r/ForexWinchester, r/FXPulse and r/GitHub_Source, using older Reddit accounts that appear three to six years old to boost perceived legitimacy.
In multiple cases, subreddits had only a handful of subscribers and were created shortly before the TradingView post.
The operation mirrors previously documented stealer activity on social platforms and code‑hosting sites in 2025. However, it stands out for its scale, persistence, and tight operational control on Reddit.
At the same time, the posting accounts carried age trophies like “Four Year Club” but showed almost no genuine activity, a pattern consistent with hijacked or purchased profiles.
The posts all promise “TradingView Premium Free,” “Lifetime Edition,” or similar variants, claiming the software is reverse‑engineered and fully unlocked for Windows, macOS and “macOS 15+.”
All identified posts follow a nearly identical template, suggesting a single operator behind the campaign.
Titles, body text and installation steps repeat the same phrases, and every post advertises three separate download buttons for Windows, macOS and macOS 15, which aligns with other AMOS campaigns that tailor payloads per macOS version to work around Gatekeeper restrictions.
The choice of github as a password is particularly notable given that GitHub has already been heavily abused as a distribution vector for both Vidar and AMOS.
Comments under these posts also show strong overlap: similar wording appears under different usernames, and “satisfied user” replies repeat the same structure, indicating the actor is likely commenting from multiple controlled accounts to simulate community engagement.
Reports from victims and researchers note that any warning comments calling the files “malware” or “stealers” disappear within minutes, pointing to active moderation by the attacker.
Each Reddit post links to three external download URLs, one per platform, all hosted on legitimate business domains that appear to have been compromised rather than newly registered.
Resource section contains a 1.7-megabyte Microsoft Cabinet archive holding 11 files with innocuous names like Ambassador, Half.gif, Impact.gif and Receipt.gif.
Downloads are provided as password‑protected ZIP archives, sometimes nested, using passwords like “github” or “codeberg” that evoke trusted developer platforms and complicate automated sandbox analysis at email or web gateways.
Identified sites include fotoflux[.]com, ghatreh[.]co, hitechprovider[.]com, techadapt[.]io and qwayglobalventures[.]com, with payloads placed under paths such as /share/, /share_windows/, /tvwin/ and /macapp/.
This technique closely mirrors other Vidar and AMOS campaigns that rely on protected archives to evade perimeter scanning.
On Windows, victims receive what looks like a bloated “TradingView Premium Desktop” installer that exceeds 780 MB, a size chosen specifically to bypass many antivirus file‑size limits.
Analysis of similar Vidar chains shows that much of this size is null‑byte padding inside the resource section, while a legitimate wextract self‑extracting stub unpacks a cabinet containing multiple benign‑looking files.
An obfuscated batch script hidden inside one of these files reconstructs the actual Vidar executable from split fragments using copy /b operations, then launches it to harvest browser credentials, cookies and cryptocurrency wallets before exfiltrating them to attacker‑controlled infrastructure.
This tradecraft is consistent with Vidar 2.0 distribution seen in other 2025–2026 social‑media campaigns.
On macOS, the download typically contains a TradingView‑themed DMG with a universal Mach‑O binary compiled for both Intel and Apple Silicon, matching techniques reported in recent AMOS campaigns.
The binary decrypts an embedded payload at runtime and executes AppleScript or similar code to access Keychain, browser data, system info and cryptocurrency wallets, then compresses and sends the data over HTTP POST to a command‑and‑control server.
Researchers have been tracking cracked‑TradingView lures on Reddit since early 2025, and this latest wave shows that the operators continue to refine infrastructure, rotate compromised domains and spin up fresh subreddits to evade takedowns.
The campaign primarily hits retail traders and crypto enthusiasts on personal machines, but corporate environments are at risk whenever employees install pirated tools on work devices.
Defenders should block known distribution domains at DNS and web proxies, monitor for large ZIP downloads following Reddit sessions, and restrict password‑protected archives at the gateway wherever possible.
On endpoints, Windows telemetry should flag wextract.exe spawning cmd.exe with large padded binaries, while macOS monitoring should watch for unsigned apps invoking osascript, dscl‑based password checks and unusual HTTP POST traffic from non‑browser processes.
Ultimately, users need clear guidance that “free” premium software especially from anonymous Reddit posts is one of the most reliable paths to credential‑stealing malware today.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…