Blockchain security firm SlowMist has issued an urgent warning about a newly identified attack campaign that uses fake trading bot repositories to steal.