Reddit TradingView Lures Deliver Vidar and AMOS Stealers
Summary
A threat actor used Reddit posts promoting cracked TradingView builds to distribute Vidar on Windows and AMOS on macOS. The active campaign used hijacked websites, password-protected archives, and social engineering to steal credentials and other data.
Key points
- The campaign used aged or compromised Reddit accounts and hijacked or newly created subreddits to promote fake TradingView Premium downloads; warning comments were deleted.
- Payloads were hosted on compromised legitimate business websites and delivered in password-protected archives using passwords such as github and codeberg.
- Windows downloads used a 784 MB executable padded with null bytes; an embedded script reassembled and launched the Vidar stealer.
- The macOS payload decrypted and ran an AMOS stealer that harvested browser credentials, cookies, wallet files, Keychain data, and other information.
- The activity was ongoing at the time of the report, with payload URLs and subreddits rotated as they were flagged.
- The report recommends blocking the identified distribution domains and hunting for suspicious Reddit browsing followed by large downloads, along with platform-specific endpoint behaviors.
- Distribution domains included fotoflux[.]com, ghatreh[.]co, hitechprovider[.]com, techadapt[.]io, and qwayglobalventures[.]com.
Article Details
- Attack Vectors
- Malicious Reddit posts in hijacked or newly created subreddits promoted cracked TradingView Premium downloads using aged or compromised accounts and coordinated comments.
- Payloads were delivered as password-protected ZIP archives hosted on compromised legitimate company websites; the Windows download used a nested archive.
- Windows execution used an oversized executable, a self-extracting cabinet, and an obfuscated batch script to reassemble and launch Vidar.
- The macOS download masqueraded as a TradingView installer. Its binary decrypted and executed an AppleScript payload that installed AMOS and harvested credentials and other data.
- macOS installation instructions directed users to allowlist the blocked application in Privacy and Security settings.
- Defensive Notes
- Block the identified distribution domains using web proxy and DNS controls.
- Consider blocking password-protected ZIP and 7z archives at email and web gateways.
- Hunt for Reddit browsing followed by a large ZIP download from an unrelated domain.
- On Windows, monitor for wextract.exe spawning cmd.exe with delayed variable expansion, unusually large executables with bloated resource sections, and batch scripts using sequential copy /b operations.
- On macOS, monitor unsigned or ad-hoc signed applications launching osascript or calling system(), unexpected dscl . authonly calls, ditto creating ZIP archives in temporary directories, and unexpected outbound HTTP POST traffic.
- Treat suspected infections as compromises and initiate incident response; the article advises considering saved passwords, session cookies, wallet keys, and locally stored tokens exposed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fotoflux[.]com | Compromised company domain used to host campaign payloads. |
| DOMAIN | ghatreh[.]co | Compromised company domain used to host campaign payloads. |
| DOMAIN | hitechprovider[.]com | Compromised company domain used to host campaign payloads. |
| DOMAIN | qwayglobalventures[.]com | Compromised company domain used to host campaign payloads. |
| DOMAIN | techadapt[.]io | Compromised company domain used to host campaign payloads. |
| IPV4 | 135[.]181[.]233[.]224 | C2 infrastructure used by the macOS stealer to exfiltrate stolen data. |
| IPV4 | 217[.]119[.]139[.]117 | C2 infrastructure used by the macOS stealer to exfiltrate stolen data. |
| SHA256 | 61191267f2d8625268cd7e488a16ab5c7b67765fb2b9bc76e4d2d97def83395a | Hash identified for the malicious macOS 15+ payload archive. |
| SHA256 | 9867207751793bcf7ebcba467b16b61cd79bbb8cd90c6f33e55141770c967a43 | Hash identified for the malicious Windows payload archive. |
| SHA256 | af547cdc1b7a9dfa507257ee416a9f2b20b85444b5d6f2f080019250426e4394 | Hash identified for the malicious macOS payload archive. |
MITRE ATT&CK
T1005 · Data from Local SystemAMOS collects local wallet files, Telegram session data, hardware UUIDs, and system profiles.T1027 · Obfuscated Files or InformationThe Windows batch script is obfuscated with character substitutions and junk lines; the macOS payload is encrypted within the binary.T1041 · Exfiltration Over C2 ChannelThe stealers exfiltrate harvested data to operator-controlled infrastructure over HTTP.T1059.002 · AppleScriptThe macOS binary decrypts and executes an AppleScript payload.T1059.003 · Windows Command ShellThe Windows payload pipes an obfuscated batch script into cmd.exe, which reassembles and launches Vidar.T1204.002 · Malicious FileVictims are enticed to download and run files disguised as cracked TradingView builds.T1555.003 · Credentials from Web BrowsersAMOS collects credentials, cookies, autofill data, and stored payment data from several browsers.
Malware
Atomic macOS Stealer (AMOS)Vidar and AMOS distribution through social media platforms and GitHub repositories has been well documented by the security community throughout 2025, and the TradingView lure specifically has been flagged by multipleVidarVidar and AMOS distribution through social media platforms and GitHub repositories has been well documented by the security community throughout 2025, and the TradingView lure specifically has been flagged by multiple