Fake TradingView AI Agent Site Drops Browser-Hijacking Malware

Executive Summary

A malicious website impersonating a TradingView AI-powered trading agent is distributing malware that grants attackers full remote control of a victim's web browser. According to Malwarebytes, the site lures users with promises of automated trading profits, then delivers a malicious executable that installs a browser-hijacking payload capable of stealing credentials, financial data, and cryptocurrency wallets.

Technical Analysis

The attack begins with a fraudulent website designed to mimic a legitimate TradingView AI agent. Victims are prompted to download a file named TradingView_AI_Agent.exe. Malwarebytes analysis indicates this executable, when run, installs a malicious browser extension or injects code that provides attackers with remote control over the victim's browser session. This control enables real-time manipulation of browser activity, including the theft of session cookies, login credentials, and sensitive data from financial and cryptocurrency exchange accounts. The malware's functionality effectively hands the attacker a live, authenticated browser, bypassing multi-factor authentication (MFA) where session cookies are valid.

Tactics, Techniques & Procedures

The threat actors employ a multi-stage infection chain. Initial access is gained through a convincing phishing lure (T1566) impersonating a legitimate financial tool. User execution (T1204) is required to run the downloaded malicious executable. The primary technique observed is Browser Session Hijacking, where the malware steals or manipulates browser sessions (T1550.004) to maintain persistent access and bypass authentication mechanisms. The objective is credential access (T1555) and data theft from financial accounts.

Threat Actor Context

The source material does not attribute this campaign to a known, named threat actor. The tactics align with financially motivated cybercriminals targeting individuals in the trading and cryptocurrency space.

Mitigations & Recommendations

Users should exercise extreme caution with unsolicited downloads, especially from sites promising automated trading returns. Verify the authenticity of trading tools by navigating directly to the official vendor's website. Security teams should consider blocking the known malicious executable hash and domain at network boundaries, though these were not provided in the source. Endpoint detection should be tuned to alert on unauthorized browser extension installations or processes attempting to inject code into browser memory.