itch.io Community » General » General Discussion

PSA: Beware the "try my game" scam Sticky

leafo · 2021-09-22T21:38:11Z

Malware is being distributed on Discord and other platforms by hackers who ask you to “try their game” by downloading an unsafe executable off the internet. This malware steals your Discord account, hacks your browser, steals payment information, and more. These hackers are using any file hosting sites they can, including itch.io, to attempt to distribute their viruses. If you receive a DM from someone you don’t fully trust asking you to download or test their game, DO NOT DOWNLOAD Even if it’s someone you DO know, if their behavior is strange then their account may have gotten hacked through this scam. Do not download any executables they try to send you On itch.io, it is safe to view the page, but do not download any untrusted software Games that run in your browser are sandboxed by your browser and pose no risk of infecting your computer If you see a zip file that is “password protected” DO NOT DOWNLOAD . Scammers encrypt their zip files with passwords so file hosts can’t run malware scans on the contents. Report this page On itch.io, you can report a page from the link located on the bottom of the page. Here’s the most common example we’ve seen: Unsuspecting user has the Discord app installed on their Windows computer They receive a DM from someone they may or may not know (it may be someone that hasn’t spoken to you in a long time, or someone from a mutual server) The hacker asks you to test a game they’re working on and provide an itch.io or other link to download the software The software is a program that reads specific files on your computer to steal your Discord API token, your Browser’s cookies, any other sensitive data. They may also delete these files after stealing them, so you effectively get “logged out” from everything after the malware rune In the example of Discord: The stolen API token gives full access to your Discord account with no restriction on where or how it can be used The scammer uses this token to: Steal your account from you (change password, email) Use stored payment information to spend thousands of dollars on Discord Nitro/Server boosts They may message from your account to your friends list/servers with the same or similar message asking others to download the file itch.io is a self publishing platform open to all, which means anyone can publish a page on our platform at any time. [1] Although we have many automated checks to block or suspend users if suspicious activity is detected (including human review in many cases), not all scans and systems are perfect. We’re releasing this notice along with a few other changes to our platform to educate and help prevent this kind of attack. itch.io at its core is a public file hosting service. Treat any page you encounter with suspicion if you are unable to vet the creators in any way. If you are concerned about the security of your computer and don’t trust any malware scanners you have on your computer then we recommend you stick to HTML5 games, as they are sandboxed by default. We also provide a Sandboxed mode in our app , but it’s difficult to guarantee security for downloaded software. Your browser is likely the safest sandbox your computer already has. Note: We will not reveal the specifics of how we handle malware uploads or other illegal activity as it’s very likely the scammers are reading this very thread. Thanks [1] Publishing can represent a broad range of states on our platform, from being indexed on our search and browse pages to just having a URL that can be shared. In this case we are referring to just creating a URL you can visit directly by link. In no instances have these pages been promoted by us on any part of our site like the homepage or browse pages More information about the scam https://www.reddit.com/r/discordapp/comments/s1f1vs/the_recent_try_my_game_discord_scam_explained/

A topic by leafo created Sep 22, 2021 Views: 63,898 Replies: 117

Viewing posts 81 to 91 of 91 · Previous page · First page

Xypherus172 days ago

https://triasels.itch.io/selatria-beta

The page is currently password protected but the messages I got line up pretty well with how this scam normally looks.

Like Reply

leafoAdmin172 days ago

Thanks for the report. The account should be taken care of.

Like Reply

Iki1209165 days ago

Hello, I just be scammed with a friend, there's two links:

https://zeroinvadersgame.itch.io/zeroinvaders
https://tuesdayquest.itch.io/a-planet-of-mine

How to do right now ? We remove the file, there's one process call WindowsBootManager a video game, we remove it too, what to do ? Change passwords on every website save in our website ? We already change password for discord, paypal etc.
I feel like my computer is a bit slower right now, but I'm not sure so what to do please ?

Like Reply

redonihunter165 days ago

How do you know you been scammed?

If you believe you were, changing passwords is a good start. But maybe not do that on a system you think is compromised.

Booting up with a secure boot disk or usb stick and scanning for hidden surprises and otherwise scanning your system thoroughly might help too.

I tried three different scanners, and the file you claimed is a scam, was not recognised as such. Of course I will not execute it to check if it silently steals my passwords anyways. If it really is a scam, this is worrssome.

Like Reply

Ezekiel_Campbell126 days ago

There's has to be a better way to avoid this scam and another better way to actually get your game tested without all your stuff getting stolen and not having

to spend a lot money on game testers.

Like Reply

Suspended account126 days ago

Show post...

yes, it is

Ichit77 days ago

Yeah.. I got hit by this. Scary stuff :(

Like Reply

MadamZori66 days ago(+1)

Thanks for the warning. I'll be more careful. Although the Internet is a dangerous place - everyone knows this.

Like Reply

wuliaoyouxijun50 days ago

I'll just push this virus to my good friend

Like Reply

xAstroBoy37 days ago (1 edit)

666 by readyygames (itch.io) , he tried but i exposed it immediately

Like Reply

Laxus7281825 days ago

Like Reply

tirosu15 days ago

returnswords by returnswords (itch.io) They're doing it by the book.

Like Reply

redonihunter9 days ago (4 edits)

Discord scams are rather easy to notice - if you have heard of them before.

What is harder to spot is fake projects. They sometimes slip through and get unoticed or rather unreported. Sometimes for weeks, sometimes months. Ironically scams have to face the same hardship all the real devs have to face. Too few visitors. And as with ratings, like most people do not rate, most people also do not hit the report button at the bottom of the page.

So basically it is like a minefield. I have even seen scams where they impersonate publishers that are on itch. Or were. Hard to thell, if there is occasional deindexing R-82637 was such a case.

And it is rather erratic how long it takes to remove the fake projects. I understand that there should not be information given that the scammers could react to. And that there are different stages of removal.

Like Reply

Viewing posts 81 to 91 of 91 · Previous page · First page