Please remove this. Another scammer
Did you put your address in here? They may have that but if you put it on credit card information on Paypal/stripe than they didn't.
Fortunately I haven’t put any personal information in my itch.io account and it’s connected to a spare email so I don’t think they have got anything valuable, they did post a game which I removed. Thanks for the telling me, I was worried about it but it seems like this and discord were the only things they took.
https://strixteam.itch.io/tanks-bloodmoon can confirm, i got this from someone as well, i immediately noticed the red flags and thankfully didnt click on the link
If you have the password you can report the page by entering the password and using the report link on the page. Keep in mind that in the case where we suspend pages, it may still show the password prompt but the page itself is not accessible at all, entering any password will fail.
in the case where we suspend pages, it may still show the password prompt but the page itself is not accessible at all
aaah. that would explain it.
If I were to implement it and delete/suspend a scammers page, I would host a "you fell for a scam, be more careful next time" page for a few weeks to educate the potential victims. If they just see nothing or nothing after entering password, they might even naivly ask the scammer for a new link.
do reports on game pages go to the page owner as well?
If you talk about the report button on game pages, that would be quite funny, if that report would go to the page owner you are complaining about.
Just click the report button if you stumble upon such scams. You can scroll down really fast or use an incognito browser, depending why you are uncomfortable visiting such pages.
They usually have two accounts. One new and one hacked. One account hosts the game and the other spams. If the hoster gets banned, the spammer then hosts the game. I assume this is because it is difficult to report the spammer. As you have pointed out, the reports go to the game page owners. You cant report users directly to itch with report buttons. there is moderation in between. A reason why these scams often happen around weekend I presume.
Not having a password protected archive, not having exe that require admin rights, being careful about stuff like runtime compressing giving false positives, hosting on itch, etc.
Scammers like to post on hacked accounts, so an established account is no guarantee for trust.
What you ask for is something like a human tested approval badge. With current itch system that is not possible. Reviews are not public in that sense. In theory you could be on public game collections to that effect. But on a game page you can not check, if the game is on such a collection.
Scammers also got more clever by allowing comments, they just delete the comments of people giving warning. And posting comment with, this is legit good game, no viruses, I promise... yeah. That is what a scammer would say ;-)
There is a reason why publishing on steam costs money.
I found one of these scammers trying to pull this on me
https://deadtrigger-pc.itch.io/deadtrigger
the page isn't up yet but maybe you can find them
How do you know you been scammed?
If you believe you were, changing passwords is a good start. But maybe not do that on a system you think is compromised.
Booting up with a secure boot disk or usb stick and scanning for hidden surprises and otherwise scanning your system thoroughly might help too.
I tried three different scanners, and the file you claimed is a scam, was not recognised as such. Of course I will not execute it to check if it silently steals my passwords anyways. If it really is a scam, this is worrssome.
If you see a pirated game on itch, chances are about 99% that it is also malware. And if the account is older, then chances are very high, that the account was recently hacked.
But I also seen complete fake games here, with random or ai made screenshots.
Also the criminals try every variation. Even faking comments and ratings. I kid you not.
The detectors used by itch will not catch all. They are soso. And also there is the user angle, like prompting the user to do something or simply downloading the malware from somewhere else and disguise it as an update function. Or simply point to an external hoster in the first place.
The only protection if we wanna call it that, is the fact that the criminals face the same problem all the real developers face. Attracting people to their games. Unfortunately that also means, that there are some time bombs in the itch archives. If the fake game was not attractive enough, maybe no one reported it. I seen stuff that was older than 6 months.
The interesting part is, that the original was hosted on itch too. And he did not say, that he got the link on discord. He said he was browsing on itch.
It is not merely a try my game problem. It is a malware is visibly hosted on itch problem - and too few people notice and report the scams, meaning, that there are "old" games hosted on itch that are malware.
There should be a warning message for all downloads here. I am serious. People should be made aware that itch does not in any way has even the slightest guarantee that the person uploading the game is the real developer and that the game is not malware or pirated or both. This psa is all good and well, but how many unique users did read this?
Oh, itch does remove things, and I guess many things are not even indexed to begin with, but there are things released without indexing as in the "classic" try my game scam and with all those scams, some of them do get indexed, suggesting a false security as new users do think that games are scrutinized by staff and are thoroughly scanned - and what else should they think?! Itch is not some shady message board. But unfortunately, whatever security measures there are, they get penetrated on a daily basis and it takes user's reports to take down malware after the fact.
The problem with indie games is, that many popular game engines and homebrew solutions tend to provoke warnings, plus games from amateurs are more easily forgiven to be buggy. So when something funny is happening, the first thing people think is not: oh, crap, that's malware. It is, oh well, amateur developer, can't be helped, I just try again. It is just that that youtuber described it. He noticed the scam only, after he got warning that his accounts were compromised. Despite having system warning messages and strange behaviour. Imagine how long it would have taken to realize it, if the scam would have included an actual game bundled with malware...
Yeah, I absolutely agree that itch.io should have 1 concise warning when downloading for the first time implemented, the same way as the warning you get when opening an 18+ game page, and that should be enough, prioritized somewhere among the optional donation window.
Having extremely active trusted users who play games become moderators who have to check uploaded games in queue to approve it's safe to download could be cool, but probably unrealistic, the biggest flaw being that some games will never be published because of just how many there are uploaded every hour
They could at least give some "trusted" users the ability to quarantine games, to shorten the exposure from the start of a report to the time staff reads the report.
And they do not even have to tell those users nor trust them. If you make a report while being logged in, they know who made the report. They could easily have a running average statistic about the quality of those reports. There is subcategories for reports and a malware category was introduced, so even that can be sorted accordingly.
So even if that user has a crappy ratio of 1 false report in 5, I would rather have 4 malwares being quarantined immediatly and 1 legit game queued for staff inspection than all 5 being visible, despite a user noticing that there is suspicous activity.
Oh, and there are legit games in quarantine all the time. What is more important? Protecting the users that think itch is a respectable site that hosts no malware or protecting the few games that get reported in error from being quarantined for a few days, till the misunderstanding clears. It might be a bad experiecne for a new developer to be quarantined, but I believe the experience of being hacked is far worse.
The issues is as follows: too few users checking out games to begin with. The scammers face the same problem as all the indie devs. Getting people to download the project. So if real developers barely get some downloads let alone ratings or comments, the time bombs uploaded by the criminals have it equally hard. So reports on malware should be treated with that in mind. I saw a year old project where people openly talked about the scam being a scam, but none of those people apparantly found the report button at the bottom or bothered to report.