Malware is being distributed on Discord and other platforms by hackers who ask you to “try their game” by downloading an unsafe executable off the internet. This malware steals your Discord account, hacks your browser, steals payment information, and more. These hackers are using any file hosting sites they can, including itch.io, to attempt to distribute their viruses.

• If you receive a DM from someone you don’t fully trust asking you to download or test their game, DO NOT DOWNLOAD
  • Even if it’s someone you DO know, if their behavior is strange then their account may have gotten hacked through this scam. Do not download any executables they try to send you
• On itch.io, it is safe to view the page, but do not download any untrusted software
• Games that run in your browser are sandboxed by your browser and pose no risk of infecting your computer
• If you see a zip file that is “password protected” DO NOT DOWNLOAD. Scammers encrypt their zip files with passwords so file hosts can’t run malware scans on the contents. Report this page
• On itch.io, you can report a page from the link located on the bottom of the page.

Here’s the most common example we’ve seen:

• Unsuspecting user has the Discord app installed on their Windows computer
• They receive a DM from someone they may or may not know (it may be someone that hasn’t spoken to you in a long time, or someone from a mutual server)
• The hacker asks you to test a game they’re working on and provide an itch.io or other link to download the software
• The software is a program that reads specific files on your computer to steal your Discord API token, your Browser’s cookies, any other sensitive data.
  • They may also delete these files after stealing them, so you effectively get “logged out” from everything after the malware rune
• In the example of Discord: The stolen API token gives full access to your Discord account with no restriction on where or how it can be used
• The scammer uses this token to:
  • Steal your account from you (change password, email)
  • Use stored payment information to spend thousands of dollars on Discord Nitro/Server boosts
  • They may message from your account to your friends list/servers with the same or similar message asking others to download the file

itch.io is a self publishing platform open to all, which means anyone can publish a page on our platform at any time.^[1] Although we have many automated checks to block or suspend users if suspicious activity is detected (including human review in many cases), not all scans and systems are perfect. We’re releasing this notice along with a few other changes to our platform to educate and help prevent this kind of attack.

itch.io at its core is a public file hosting service. Treat any page you encounter with suspicion if you are unable to vet the creators in any way. If you are concerned about the security of your computer and don’t trust any malware scanners you have on your computer then we recommend you stick to HTML5 games, as they are sandboxed by default. We also provide a Sandboxed mode in our app, but it’s difficult to guarantee security for downloaded software. Your browser is likely the safest sandbox your computer already has.

Note: We will not reveal the specifics of how we handle malware uploads or other illegal activity as it’s very likely the scammers are reading this very thread.

Thanks

^[1] Publishing can represent a broad range of states on our platform, from being indexed on our search and browse pages to just having a URL that can be shared. In this case we are referring to just creating a URL you can visit directly by link. In no instances have these pages been promoted by us on any part of our site like the homepage or browse pages

More information about the scam

• https://www.reddit.com/r/discordapp/comments/s1f1vs/the_recent_try_my_game_discord_scam_explained/

https://mandagame.itch.io/manda 

edit; thanks for deleting that one, these guys are horrible

https://helpercat.itch.io/helpercat is one of those, please remove it

https://helpercats.itch.io/helper-cat Please remove this file from this site

Thank you :DDD

What about if I didn't receive the link through Discord, like this HelperCat game that some people are reporting appeared in my feed as any other. So how can we check this? Running an antivirus doesn't help in all cases

Really...Why there are so many "games"...that they are virus...?

I found another scammer one just today https://evadevs.itch.io/cyberika

I got scammed another way via a hacked friends account and a suspicious website but I got refunded

https://trabusvr.itch.io/trabus

https://zinetragames.itch.io/tribus-gamebynetra Yea, this one got my boy. My innocent boy.

just letting people there is another one being sent around, https://hexagondeveloper.itch.io/  at least i think it might be, thought i should let you guys know

Friend of mine got her account stolen 2 days ago because of the discord scam, but the ''game'' also tried to steal her Roblox account for some reason.

https://arsenaldevlopr.itch.io/ is another malware link

Thank you for the hard work, leafo and all the staff at Itch! I know this announcement was posted weeks ago, but a good number of us weren't aware of it (I don't have Discord installed and I don't pay for Nitro). 😰

I'll do my best to try to send this to all the other devs at the other server. Thank you for sharing and I hope this blows over soon!

Malware here: https://asurad.itch.io/cold-crystals

https://itch.io/profile/akitarsal
Got one right here for you.

i think what makes this whole situation worse is discord won't do anything about it

as far as i know i know they are upgrading scam link detection but i still think its very wrong of them not to take action.

which if they are helping victims who have been previously hacked, they SHOULD say something about it so people know "hey we're aware of the hackers, we're taking care of it." but they choose not to.

I'm glad that I didn't run on this Discord issue (or at least, I believe so) . But I got hacked past year too, someone managed to invade both my Instagram and Facebook accounts. I know they had stolen my (old) password. I'm a bit worried about if they managed to stole other passwords of mine and have invaded other accounts than these I mentioned.

https://pastaaghi.itch.io/pastaghi

Please remove this. Another scammer

https://clasus.itch.io/kingsgold

Here's another one https://3dgirls.itch.io . This as an imitation of a game by Killer7 that he's not releasing publicly. He posted on his site that it is a scam. I didn't know it it had been reported to itch or not.

Here's something I found. https://viselalune.itch.io/a-fathers-sins . The game was published by pixelblink. I suspect it is an attempt to load malware, since the file size is larger than the creator's.

Hi. I recently got asked on one of my YouTube videos to try a game on here called Mandela Corruption, me being a newbie on this site I obliged, downloaded and recorded the game and was going to upload it to my channel but when I tried to look for the game, it has vanished.  Does anybody have any ideas about its authenticity, or was it a scam?  As soon as I finished playing the game I did delete it! 

We just had someone trying this as well in our discord. I can't confirm but I googled him and found this twitter which leads to an itch.io, the minute you don't agree he starts berating you.
Discord: IseGuy#3384 (Confirmed legit discord user, not new/throwaway account)
https://twitter.com/zuhayrimohamed
https://itch.io/profile/vazsun
The account may be compromised or the account may just be a copy.

https://strixteam.itch.io/tanks-bloodmoon remove this as well, directs to the same "game" as above

Got this one this morning, same deal https://incalexteam.itch.io/tanks-bloodmoon

Not often that I post here, but figured that since it's an ongoing theme, i'd help the cause. Current link is https://quinteam.itch.io/tanks-bloodmania, and the password is TANKS123. Seeing how the friend that sent it hasn't messaged me for 5 years....was kind of obvious it was fake XD But I will admit, after chatting with the scammer, they've improved, actually kept up a decent conversation with them

So does this get read or how does this work?  Because everything below that post 164 days ago is still online. Or so it seams.

It leads to password protected sites. And the thing is, you cannot report those pages, without the password. So if the actual scammed people did not click on report, there are no reports. And I believe scammed people have other things to do, shortly after being hacked than to think about going back there. Maybe they even forgot the password to access  the site. Especially if they copied it from discord and now have lost access to that.

Also, the people that got suspicious before, will not even go there and click report. They might not even know itch, unless they got the discord invite from here.

https://insalexteam.itch.io/tankie happened to me as well, ran the exe which stole my discord account and compromised two emails.

https://itch.io/profile/ahmettaha

This one is desperately spamming every game community to get people to download a very suspicious game, I think he stole this (paid) game:

https://store.steampowered.com/app/813700/Sakura_Sadist/

Not even sure if the download link will lead to the actual game or something worse...

I JUST WANNA PLAY PT ONILE

will this not prevent game promotion? 

when i scam is trying to get me i will report it to the moderators because thats what i do

https://itch.io/profile/xpsycho

appears to be an account stolen using the try my game scam, now being used to proliferate the scam.

ETA: Another account got caught by this same scammer and is now being used as well:

https://itch.io/profile/tonythepoisse

These have been spamming an NSFW version of the scam on SFW game pages.

Edit 2: Thanks.

https://frostprojects.itch.io/tempo-quest  This one hit a friend recently

https://tempooteam.itch.io
https://tempooteam.itch.io/tanks-bloodmania
These ones trying to steal my discord be careful alwaqys the same tank game

Two more accounts doing the "Try my game" scam, one that appears to have been stolen by the scam and one by the scammers.

https://itch.io/profile/xpsycho

https://fignats.itch.io

I found one of these scammers trying to pull this on me

https://deadtrigger-pc.itch.io/deadtrigger

the page isn't up yet but maybe you can find them

https://hatanopowell.itch.io/maritas-games
take this down please, thanks!!

There's has to be a better way to avoid this scam and another better way to actually get your game tested without all your stuff getting stolen and not having

to spend a lot money on game testers.

Yeah.. I got hit by this. Scary stuff :(

Thanks for the warning. I'll be more careful. Although the Internet is a dangerous place - everyone knows this.

I'll just push this virus to my good friend

666 by readyygames (itch.io) , he tried but i exposed it immediately

ok

returnswords by returnswords (itch.io) They're doing it by the book.

Discord scams are rather easy to notice - if you have heard of them before.

What is harder to spot is fake projects. They sometimes slip through and get unoticed or rather unreported. Sometimes for weeks, sometimes months. Ironically scams have to face the same hardship all the real devs have to face. Too few visitors. And as with ratings, like most people do not rate, most people also do not hit the report button at the bottom of the page.

So basically it is like a minefield. I have even seen scams where they impersonate publishers that are on itch. Or were. Hard to thell, if there is occasional deindexing R-82637 was such a case.

And it is rather erratic how long it takes to remove the fake projects. I understand that there should not be information given that the scammers could react to. And that there are different stages of removal.

You take too long to act on reports. R-84586 for example. It is not weekend. That is 60 hours and counting.

And regarding weekends, you have to solve that problem too. You allow malware spreaders to do their thing unprotested, just because of what the calendar says.

Users that did notice that something is malware cannot even give warning to other users, because there are no public reviews attached to a project. And comments can be deleted by the developer.

As it is now, you should give a big warning message like that quarantine message for each download and doubly for each external link.

What is more important? Not delisting a game for manual review, because the report might be in error or even malicious, or allowing a potential malware to continue to spread being under the umbrella of appearing legit, because it is hosted on indexed on itch?

If you do not have such a system already, fastrack reports of "known" reporters, maybe even to auto-delist a reported game, if the report cannot be processed by staff within minutes.

And should you have a system of protecting accounts against reports, just because they are older, have 2fa, payment information or whatever, scratch that system. It is contra productive. The scammers use hacked accounts for a reason. And the hacked accounts prove beyond any doubt, that there is a huge problem.

You need to fix this. This is not a one time occurence. It is a systematic problem, and the criminals are exploiting it. R-84776. Are the reports not believed? Is information missing? Are other things more important for staff to do than protecting the users of this site against scams?

What the hell is with the weird trend of user profile pictures being of small children on twitch and elsewhere just like the Original poster's profile picture back when the OP was made? 

It is a systematic problem

R-87841 R-87648

The systematic problem continues. I do not know how your system works, but I do see that it is not effective.

R-85035 might also be because of the same systematic problem.

Yes

Dominic 

HI

R-94456

This looks like a specific discord credential stealer. One scanner calls it  Python/DiscordBot.FF another one PYC/Stealer.A.gen!Camelot

The concerning thing is, this is out in the open. Indexed for months now. Even some comments talking about how something is fishy with the description. Why did those commentors not report the fake game? It is of course a horror game, as Itch is a hotspot for people trying out indie horror games.

It also begs the question, why the scanners used by Itch does not catch those things. Oh, I can explain it logically, but emotionally it is outrageous. There is no regular manual review of uploaders or uploaded content and the automatic process might be good, but not good enough. (Oh, I guess they just upload 100 malware and if 5 get indexed they know what the scanners will not recognise. It would be trivial if you think about it. I have also seen malware that did not get recognises at all on that internet scanner that uses 70 different scanners).

Anyways please make the situation better. It is heart breaking to see all those hacked accounts every week, which proves, people do fall for the scams.

And for anyone recognising a scam, please do report it. Itch is abused by scammers all night and day and if no one reports the scams, they will not get removed. My oldest seen scam was two years in the open.

You should give priority to reports from sources that made valid reports in the past. Reports are rare, as seen in the example above. Other people saw that the fake game was suspicous, two even commented. But how many reports did you get on this?

Same as you should deprioritze reports from sources that made invalid reports in the past, to declutter the things staff has to do.

Oh, and there is a "new" method of scamming. It is unattached blog posts with a link to malware on the bottom. Those are harder to report, because there is no report button. Those blog posts are not even searchable. But they do get listed in regular search engines and look somewhat legit, since they are hosted on Itch.  Request 219519 has some of those, since it is hard to report them, as blog posts have no report button.

Thank you! I was already paying attention, but I need more attention...

My print-and-play pdf has been flagged. I guess we just wait for mods to verify that it’s fine?

The downloadable game has a redirect link to get the latest version from Gitlab.

sigma game

hello

thanks for the tip bro. but i left discord long time ago

hey my friend over here at https://cubestuffreal.itch.io/cag-cubes-and-guns
and myself
we are not a part of this scam we didnt know it even existed
me and my friend just advertise our games at discord
and make servers for those games
we are litterly not a part of this scam thingy

soooo unquarntie the page
i alr played my friend game and it is fine
checked f12 it doesnt fisch passwords or anything