Fake TradingView Premium Reddit Posts Spread Vidar and AMOS Stealers

A coordinated campaign is abusing Reddit to distribute fake "TradingView Premium" installers that install Vidar on Windows and AMOS on macOS; operators use compromised business domains, password-protected and nested archives, large padded installers, and likely purchased or hijacked Reddit accounts to evade detection and simulate legitimacy. The report details artifacts and behaviors (archive passwords like "github", wextract-based reconstruction on Windows, universal Mach-O binaries and osascript usage on macOS), lists observed distribution domains and paths, and recommends blocking domains, monitoring for large downloads after Reddit sessions, and endpoint detections for wextract/cmd.exe on Windows and unsigned macOS apps invoking osascript or unusual HTTP POST traffic.