According to CoinMeta, Wu learned that Mantis Bitcoin tweeted that the account cryptotrice has been promoting what it claims to be a “cracked version of tradingview premium” since mid-October, enticing users to download encrypted compressed files and run key generators. Mantis Bitcoin’s analysis confirmed that this Windows sample collects browser credentials, encrypted wallet information, and Telegram data, which is then sent to the attacker’s server. The download link arche-hypnose [.] com appears to be from a legitimate website macOS that has been compromised; currently, this link returns a 404 error, and Mantis Bitcoin has not yet obtained the corresponding sample.