TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Malwarebytes Labs

Malicious trading website drops malware that hands your browser to attackers

2026-04-22 · Read original ↗

ATT&CK techniques detected

6 predictions
T1055.012Process Hollowing
99%
". exe ) using a technique known as process hollowing. the stealer is developed in golang, and most of the functions are implemented in the “ ext ” package. what the malware does once installed, the needle core module can : take screenshots of the infected system steal browser dat…"
T1055.012Process Hollowing
95%
"##aw as an ai trading tool. the site itself behaves selectively. in some cases, visitors are shown the fake tradingclaw page, while in others they are redirected to a different site ( studypages [. ] com ). this kind of filtering is commonly used by attackers to avoid detection a…"
T1176Software Extensions
86%
"key. it tells the malware where to send stolen data ( the command - and - control server ), which malicious extension to install, and which features to enable. the stealer extension is dropped in a random folder in the path % localappdata % \ packages \ extensions. the folder con…"
T1176.001Browser Extensions
84%
"key. it tells the malware where to send stolen data ( the command - and - control server ), which malicious extension to install, and which features to enable. the stealer extension is dropped in a random folder in the path % localappdata % \ packages \ extensions. the folder con…"
T1071Application Layer Protocol
72%
"file : { " extension _ host " : { }, " api _ key " : " … " server _ url " : " https : / / c2 / api / v2 ", " self _ destruct " : true, " base _ extension " : true, " ext _ manifest " : { " account _ extension _ type " : 0, " active _ permissions " : { " api " : [ " history ", " n…"
T1071.001Web Protocols
49%
". run a full scan with malwarebytes. indicators of compromise ( iocs ) hash 95dcac62fc15e99d112d812f7687292e34de0e8e0a39e4f12082f726fa1b50ed 0d10a6472facabf7d7a8cfd2492fc990b890754c3d90888ef9fe5b2d2cca41c0 domains tradingclaw [. ] pro : fake website chrocustumapp [. ] com : relat…"

Summary

A fake TradingView AI agent site leads to malware that can take over your browser, steal your accounts and financial data, and open the door to further attacks.