Fake TradingView macOS installer via YouTube ad

macOS software Installer / update channel

SafeDep: a YouTube video ad impersonating TradingView delivered a fake
.pkg installer. Inside: a self-healing LaunchAgent, an AES-encrypted
V8 bytecode payload, and a Node.js MITM proxy trusted by a rogue root
CA. Same class as fake corepack.org (AS61): brandjacked developer-tool
download, not a registry hijack.

Mapped techniques

T0136 Brandjacking
T0110 Advertise malicious artifact
T0153 Compromised developer workstation

supply-chain malvertising installer

T0136 · Initial Access · Brandjacking

TradingView impersonation in a YouTube ad and .pkg.

T0110 · Resource Development · Advertise malicious artifact

Paid/video ad as the distribution channel.

T0153 · Initial Access · Compromised developer workstation

Fake installer on macOS with LaunchAgent persistence.

Sources

https://safedep.io/youtube-ad-fake-tradingview-macos-stealer