Skip to main content

Indie game storeFree gamesFun gamesHorror games
Game developmentAssetsComics
SalesBundles
Jobs
TagsGame Engines

Malware is unfortunately nothing new, and it's nearly impossible for communities such as itch.io to make the site 100% free of malicious software no matter how well moderated  it is. Now I've been a moderator on an other game site, and a few things came to my attention.

If you see a game with high quality graphics in the screenshots but the downloads are less than 1MB, you can be pretty sure it's just malware. I've only seen such low download sizes with games that use the console or are even entirely set up as a batch file (which is then mostly noted in the description as well). Very large downloads that turned out to be malware were very rare in my experience (not entirely  non-existent, though). 

What I also saw a lot with malware games was that they were dupes of legit games and then just searching the website can be a good idea. 


Now much malware focusing on Windows is only a logical step  as Windows is one of the most used  systems, however as Linux is gaining popularity lately, it only stands to reason that Linux gets more and more interesting for malware developers. Although Linux is an environment that may be harder for malware to do crazy things with, there's always a possibility and malware  developers are used to challenges, as they have to outsmart  anti-virus software (which also gets more and more sophisticated) all the time. 

Now what can also be a good one. I've seen multiple games from the same dev account reported in my own moderator days and all the malicious downloads turned out to be IDENTICAL on all the "games" they uploaded. 

Well, I don't want to pretend I'm an expert  on malware, but at least I can share what I've seen a lot

"If you see a game with high quality graphics in the screenshots but the downloads are less than 1MB, you can be pretty sure it's just malware. "
That's not always the case. For my game the exe contains no graphic assets at all, they are loaded from our servers at login.

What i would recommend instead is testing the exe with websites like https://www.virustotal.com/gui/home/upload
There you can test any executable automatically (and for free) against 30 common antiviruses.

"Exceptions confirm the rule" we say in Dutch.

Yeah, virustotal can be a big help, although you should also be careful on that one, as some virus scanners there will easily throw false positives (and also false negatives). 

You can do scanning, but take the results with a grain of salt. If it were easy to dectect, Itch would have auto quarantined it. They have scanners too.

And practially all the usual game engines have or had false positives. Godot packed exes are notorious for that. But also renpy and rpgmaker and probably all the others at one version or another.

Plus I have seen malware that did not trigger. I know it was malware because of circumstances. Some tactics involve downloading the payload at a later time, so there is nothing there yet to scan. Also, just stealing your data is harm, but very hard to scan for.