{"id":11914,"date":"2026-04-07T10:03:36","date_gmt":"2026-04-07T10:03:36","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/07\/hackers-use-fake-tradingview-premium-posts-on-reddit-to-deliver-vidar-and-amos-stealers\/"},"modified":"2026-04-07T10:03:36","modified_gmt":"2026-04-07T10:03:36","slug":"hackers-use-fake-tradingview-premium-posts-on-reddit-to-deliver-vidar-and-amos-stealers","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/07\/hackers-use-fake-tradingview-premium-posts-on-reddit-to-deliver-vidar-and-amos-stealers\/","title":{"rendered":"Hackers Use Fake TradingView Premium Posts on Reddit to Deliver Vidar and AMOS Stealers"},"content":{"rendered":"

Hackers Use Fake TradingView Premium Posts on Reddit to Deliver Vidar and AMOS Stealers
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A threat actor has been running an active campaign on Reddit, using fake posts that promise free TradingView Premium access to deliver two malware families \u2014 Vidar on Windows and AMOS on macOS. The operation is still live, with new posts surfacing as older ones get taken down.<\/a><\/p>\n

TradingView is one of the most widely used charting platforms among retail traders, crypto investors, and forex enthusiasts. Its Premium subscription unlocks advanced indicators and real-time market data at a price many users would rather skip. <\/p>\n

The threat actor exploits that gap by posting across multiple subreddits \u2014 some hijacked, others purpose-built \u2014 with step-by-step instructions that walk victims through the full infection chain without raising suspicion.<\/a><\/p>\n

Hexastrike analysts traced these infections<\/a> back to Reddit while handling several recent stealer cases. <\/p>\n

They identified a single threat actor operating across at least five subreddits, using aged, purchased, or compromised accounts to appear credible. <\/p>\n

What stands out is not technical complexity but operational discipline \u2014 hosting domains get swapped the moment they are flagged, warning comments from real users are deleted within minutes, and the posts appear LLM-generated to keep a consistent tone.<\/a><\/p>\n

The subreddits tell a clear story. r\/BitBullito and r\/CryptoCurrencyDM had just two and 29 subscribers respectively, while the accounts posting in them were three to six years old \u2014 lending false legitimacy to the operation. <\/p>\n

One account, u\/BroadDepartment573, carried a Four Year Club Reddit trophy but had only a single post across its entire history.<\/p>\n

\n
\"Reddit
Reddit profile of u \u2013 BroadDepartment573 showing the Four Year Club trophy alongside an otherwise empty activity history (Source \u2013 Hexastrike)<\/figcaption><\/figure>\n<\/div>\n

Every post follows the same template, claiming the software was reverse engineered with all license checks removed. <\/p>\n

\n
\"Post
Post body claiming the software is reverse engineered with all license checks removed and premium access unlocked forever (Source \u2013 Hexastrike)<\/figcaption><\/figure>\n<\/div>\n

Separate download links are offered for Windows, macOS, and macOS 15 \u2014 a level of platform targeting that shows the actor understands Apple\u2019s Gatekeeper restrictions<\/a> in macOS Sequoia. <\/p>\n

The Infection Mechanism<\/strong><\/h2>\n

Payloads are hosted on compromised legitimate business websites, lending added credibility to the download links. <\/p>\n

On Windows, the extracted executable is bloated to over 784 megabytes through null-byte padding in its PE resource section, deliberately sized to exceed antivirus scan limits. <\/p>\n

\n
\"Entropy
Entropy graph of the executable showing the resource section filled almost entirely with zero-byte padding (Source \u2013 Hexastrike)<\/figcaption><\/figure>\n<\/div>\n

Beneath the padding sits a 44-kilobyte self-extracting cabinet that drops a batch script named Receipt.gif. <\/p>\n

Despite the image extension, it is a 235-line obfuscated script that reassembles a Vidar infostealer<\/a> from split file fragments using character substitution to defeat signature-based detection. <\/p>\n

\n
\"First
First lines of Receipt.gif showing the Set variable chain with random dictionary words inserted as obfuscation padding (Source \u2013 Hexastrike)<\/figcaption><\/figure>\n<\/div>\n

The archive password \u2014 either \u201cgithub\u201d or \u201ccodeberg\u201d \u2014 is posted directly in the Reddit thread, both names chosen to evoke legitimate developer platforms and lower suspicion.<\/a><\/p>\n

On macOS, the download is a disk image that mounts with a TradingView-branded background to mimic a real installer. Inside sits a compact 217-kilobyte Mach-O binary that decrypts an AMOS stealer<\/a> at runtime through a polymorphic XOR loop. <\/p>\n

Once executed, AMOS harvests credentials and cookies from Chrome, Firefox, Safari, Brave, Edge, and Opera, copies wallet files from Exodus, Electrum, and MetaMask, and exfiltrates everything over HTTP within seconds. <\/p>\n

\n
\"Mounted
Mounted TradingView DMG showing the application icon over a branded background designed to appear like a legitimate installer (Source \u2013 Hexastrike)<\/figcaption><\/figure>\n<\/div>\n

Organizations should add the identified distribution domains to web proxy and DNS blocklists, and hunt for patterns where Reddit browsing is followed quickly by a large ZIP download from an unrelated domain. <\/p>\n

On Windows, flag wextract.exe spawning cmd.exe with delayed variable expansion. On macOS, monitor for unsigned applications calling osascript or making unexpected dscl authonly credential validation attempts. <\/p>\n

Anyone with any doubt about exposure should treat it as a confirmed compromise \u2014 browser passwords, session cookies, and crypto wallet<\/a> keys should all be considered stolen. Downloading cracked software remains one of the most reliable ways threat actors find victims today.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Hackers Use Fake TradingView Premium Posts on Reddit to Deliver Vidar and AMOS Stealers<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers Use Fake TradingView Premium Posts on Reddit to Deliver Vidar and AMOS Stealers A threat actor has been running an active campaign on Reddit, using fake posts that promise free TradingView Premium access to deliver two malware families \u2014 Vidar on Windows and AMOS on macOS. The operation is still live, with new posts […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-11914","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11914"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11914"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11914\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11914"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11914"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}