Someone is using your game to spread malware. What to do.
A player writes to you, upset. A friend on Discord asked them to test "your" game, they downloaded it, and now their accounts are gone. You never sent that message. The page they were sent has your screenshots, your description and your name, and the download is not your game.
A game we shipped was taken apart, rebuilt and sold by someone else, so we know what it is like to find your work under someone else's control. This is a harder version of that feeling, because the people being hurt are your players and the thing hurting them wears your face. It is not your fault, and it happens to small games precisely because players trust small developers. This page covers how to tell what kind of fake you are looking at, which reports work fastest, who can remove each part, what to tell players, what to do if your real game gets flagged afterwards, and what to set up before it happens again. It is not legal advice, and the places where a lawyer is worth paying are marked.
The short answer
- Do not download or run the file. Save the page address, the download address, screenshots and the message players received. That is enough to report it.
- Get browsers to warn first. Report the page and the download link to Google Safe Browsing and Microsoft. A warning protects players even while the host is slow to act.
- Report it where it lives. Send a malware report to the host of the page, the file host and the platform where the messages are spreading. A copyright notice is a second route if they used your art or text, not the first.
- Tell your players, plainly and in one place. Say where the real game is, that you never ask people to test builds in private messages, and what to do if they ran the fake.
- Prepare for the next one. One official links page, signed Windows builds, two-factor login on every team account, and a regular search for your own screenshots, because some fakes change the name.
1. Work out what kind of fake it is
Security researchers have documented this pattern for years, and the reports describe a few distinct kinds. Which one you have decides who you report to and what you tell players.
| What you see | What it is | Example |
|---|---|---|
| A page with your game's name, screenshots and description, offering a download you did not make | A lookalike page, often styled like an itch.io page, hosted on a blog service or a cheap domain. The file is malware. | Malwarebytes described lookalike pages for the indie platformer Archimoulin, which "impersonates" the real game and delivered a hidden loader instead (October 2025). |
| Your art, trailer or branding under a different game name | A rebrand. The criminals invent a title and dress it in your work so a search for your name may never find it. | Acronis found fake sites that took the game Project Feline and "rebranded it" as Dire Talon, and another that took The Braves and called it WarHeirs (July 2025). |
| Private messages asking people to test "your" game, often from a friend's account | The delivery method. Accounts stolen by the malware are used to send the same message to the victim's friends. | Itch.io's own warning describes the "try my game" scam and how the stolen account is used to message the victim's friends list and servers. |
| A file claiming to be your game, a crack of it or a leaked build, on a download or leak site | Malware riding on demand for your game. Often no real game is inside it at all. | Acronis found that none of the fake game samples it analyzed "contained any real game content". |
None of these require anyone to have broken into your build. The criminals only need what you have already published: your name, your store page, your screenshots and your trailer. That is why it happens to games with small, trusting communities, and why the defense is mostly about making the real game easy to recognize.
2. Save the evidence without touching the file
Treat the download as dangerous. You do not need to open it to report it, and you should never open it on the machine that holds your project, your store accounts or your signing keys.
- The page. Its full address, a dated screenshot of the whole page, and the address the download button points to. Copy that address as text rather than clicking it.
- The messages. A screenshot of the message players received, the account that sent it and the server it came from, with the date. Ask the player who wrote to you for theirs.
- Anything else with the same look. Fake sites in one campaign often share a template; Malwarebytes noted one campaign uses a standard template, which makes the next copy easier to recognize.
- A note of what is yours. Which screenshots, text and video were taken from your page, and where each was first published. You will need this for a copyright notice in section 4 and it costs nothing to write now.
Be careful with online scanning services. VirusTotal's documentation says the contents of submitted files "may also be shared with premium VirusTotal customers". That is fine for the criminals' file, but never upload your own unreleased build to check it, because you would be sharing it.
3. Get browsers to warn before anything else
Removing the page can be slow. Malwarebytes wrote that the hosts these campaigns use are "very unresponsive to take down requests", often sit behind Cloudflare, and that the operators simply set up a new site when one falls. A browser warning does not wait for the host. It appears in front of the page or the download for anyone whose browser checks the list.
- Google Safe Browsing. The report form takes a page address, a threat type and up to 800 characters of detail. Report both the page and the direct download address. Say in the details that the page impersonates your game and distributes malware, and give your real page's address.
- Microsoft. Microsoft takes reports of unsafe sites. Its Defender SmartScreen checks visited sites and downloaded files "against a dynamic list of reported phishing sites and malicious software sites" and warns when one matches.
Both forms are free and take a few minutes. In our view they are the highest-value few minutes in this whole page, because they reach players you will never be able to talk to.
4. Report it where it lives
Every fake has a few parts, and each part has a different company behind it: the page, the file, the messages that spread it, and sometimes a video or a domain. Report each one. Use the company's malware or abuse channel first. You are reporting harm to people, which every one of these services prohibits, and you do not have to prove you own anything to do it.
| Where it is | What to report |
|---|---|
| A Blogger or Blogspot page | Google's Blogger rules prohibit both impersonation and malware, including "the direct hosting, embedding, or transmission of malware." Report the blog through Blogger's abuse reporting and name both. |
| A page on itch.io or another store | Itch.io says to report a page "from the link located on the bottom of the page". If it uses your game's name, say so; you are the person best placed to confirm it is not yours. |
| A file on Dropbox, Discord's file links or another file host | The file host's abuse report. Give the exact download address. Malwarebytes found files offered on Dropbox, Catbox and Discord's content network. |
| Messages on Discord | Report the messages and the sending accounts inside Discord. Discord's own safety guide explains that a hijacked account can be used to "impersonate you to trick unsuspecting members", so the sender is often a victim too. Tell your server's moderators what the message looks like. |
| A YouTube video promoting the fake | YouTube's spam policy prohibits content made to send viewers to "external sites, especially those hosting prohibited material like malware". Acronis found fake games promoted through fake YouTube channels. |
| A site behind Cloudflare | Cloudflare's abuse form has a Phishing & Malware category. For sites it only passes traffic to, Cloudflare says it "will forward your report to the hosting provider and website operator", and it lists content that disseminates "active malware" among what it may block or remove. |
| Its own domain | Look up the domain's registrar with ICANN's lookup tool and send the registrar's abuse contact the same evidence. Section 7 covers the slower trademark route for domains that use your game's name. |
If the fake copied your screenshots, trailer or description, you can also send a copyright notice to the same host. It is a second lever, not the first: a notice is a sworn statement about your work, it asks the host to remove only what is yours, and a malware report asks it to remove the whole thing. The first page in this journal explains what a valid notice contains, and the page on stolen art and assets covers proving which pieces are yours.
5. Tell your players, once and clearly
Players who were hurt may blame you, and players who were not hurt are about to see the same message. A short, calm statement does more than anything else here. Put it everywhere your players already look: your store page's news, your Discord's announcements, your social accounts. Our suggestion for what it should say:
- What is happening. A fake page or message is using the game's name or art to spread malware.
- Where the real game is. List every real place, with links you control. If there is no Windows download outside Steam, say exactly that.
- What you never do. If you never ask people to test builds through private messages, say so. Itch.io's own advice is that a password-protected zip is a warning sign, because scammers use passwords so "file hosts can't run malware scans on the contents".
- What to do if they ran it. Malwarebytes' advice for victims of these fakes is to use a different, clean device to change passwords for Discord, email and Steam, turn on two-factor login, sign out every session, then deal with the infected computer.
A plain version you can adapt:
Someone is sending messages and links asking people to test [game]. Those files are not from us and they contain malware. The only places to get [game] are [real links]. We never ask anyone to download a test build through a private message. If you ran one of these files, change your Discord, email and Steam passwords from a different device, turn on two-factor login, and sign out all sessions. We're sorry this is happening, and we're reporting every copy we find.
Do not post the fake link as a clickable link, even to warn people. Describe it, or show a screenshot with the address visible. Do not name or threaten the friends whose accounts sent the messages; most of them were the first victims.
6. If your real game gets flagged afterwards
A fake can leave a mark on the real game. A player's antivirus may flag your genuine file, or a browser may warn on your genuine page, especially if your game's name now appears in malware reports. Both Google and Microsoft have a route for this.
- A wrongly flagged page. Google's Safe Browsing form also covers "a legitimate page where Safe Browsing is incorrectly displaying a warning".
- A wrongly flagged file. Microsoft analyzes files "that you believe have been incorrectly classified as malware", and has a separate option for software developers wanting their own programs checked.
- The "unrecognized app" warning. This is a different thing. SmartScreen warns about files without an established reputation, and it checks "the digital signature used to sign a file" as part of that reputation. It is not a sign that your file is malicious, but it does make a real game look the same as a fake one. Section 9 covers signing.
7. Domains that use your game's name
If a fake lives on a domain built from your game's name, you can ask for the domain itself through the Uniform Domain-Name Dispute-Resolution Policy, which most domain registrars accept. You must show three things: that the domain is "identical or confusingly similar" to a trademark you have rights in, that the holder has no legitimate interest in it, and that it was registered and is being used in bad faith. A case before WIPO with one panelist costs 1,500 U.S. dollars for one to five domains.
Our view: for a throwaway domain that will be abandoned within weeks, the registrar's abuse contact and the browser warnings are faster and free. The dispute route is worth it when a domain with your name keeps being used, or when it could confuse players for years. Whether your unregistered game name counts as a trademark is a question for a lawyer; the page on trademarking a game name explains what registration adds.
8. Can you find out who did it?
Usually not, and it is worth saying that plainly so you can stop looking. These campaigns run on stolen accounts, rented malware and sites that are replaced when they fall. The people running them are not developers who copied your game; they are criminals who needed a believable cover, and yours was available. In the United States, players who lost money and developers who want a record can report to the FBI's Internet Crime Complaint Center. Elsewhere, your national police or cybercrime agency is the equivalent. Do not expect a reply, and do not let the search for a culprit take time from the warnings in sections 3 and 5.
9. Make the next fake easier to spot
You cannot stop strangers from copying your screenshots. You can make it easy for players to tell the real game from a fake, and make your own accounts harder to turn against your community.
- One official links page. A single page, on a domain you own, that lists every real place to get the game. Link it from your store pages, your Discord and your social profiles, and point to it in every statement.
- Say how you distribute builds, before anyone asks. A line in your Discord rules and on your page, such as "We never send builds in private messages," gives players something to check a suspicious message against.
- Sign your Windows builds. A code-signing certificate lets your builds build a reputation that a fake cannot borrow, which matters because SmartScreen weighs the signature as part of that reputation. A signature does not make a fake impossible, but it makes the real file look different from one.
- Lock down every team account. Two-factor login on Discord, email, store and social accounts for everyone who can post as the game. A stolen developer account is the most convincing lure there is, and Discord's guide notes a hijacked moderator account can be used to impersonate you.
- Search for your pictures, not just your name. Rebranded fakes change the title. A reverse image search on your key art and best screenshots, done now and then, finds copies a name search misses.
- Keep your statement ready. Write the warning in section 5 with your real links filled in, and keep it somewhere you can paste from on a bad day.
Fakes of this kind also follow demand for leaks and cracks. If your game has a leaked build or a pirate copy in circulation, the pages on a build leaked before release and on pirate download sites cover those parts.
Common questions
Someone is using my game's name to spread a virus. Am I responsible?
You did not make or send the file, and the reports in this page describe criminals copying public store pages. Your job is to warn players and report the copies quickly. If a player tells you they lost money, point them to their bank and to the police.
What is the "try my game" scam?
A message, often from a friend's hijacked account, asks you to download and test a game. The file steals account logins, browser data and payment details, and the stolen account sends the same message to more people.
What is the fastest way to protect players from a fake download page?
Report the page and the download address to Google Safe Browsing and to Microsoft. Their warnings appear in browsers whether or not the host removes the page.
Should I send a copyright notice or a malware report?
Start with a malware report: it covers the whole page and needs no proof of ownership. Add a copyright notice if the host does not act and the page copied your screenshots, video or text.
Players say my real game is a virus because of the fakes. What do I do?
Post one statement listing where the real game is. If antivirus software flags your real file, submit it to the vendor as a false positive; if a browser warns on your real page, use Google's Safe Browsing form to report the mistake.
Should I scan the fake file myself?
No. You do not need the file to report the page. If you want a scan, give the scanning service the download address rather than running the file, and never upload your own unreleased builds to a public scanner.
Do I need a lawyer?
Not to report pages, files, messages or videos. A lawyer is worth it for a domain dispute, for a fake that keeps returning on the same domain, or if anyone claims you are responsible for harm the fake caused.
This page describes Malwarebytes' reports of 3 January 2025 and 8 October 2025; the Acronis Threat Research Unit report of 23 July 2025; itch.io's "try my game" warning; Google's Safe Browsing report form; Microsoft's unsafe-site report page, its file submission page and its Defender SmartScreen overview; Google's Blogger content policy; YouTube's spam and deceptive practices policy; Cloudflare's abuse approach and abuse reporting pages; Discord's guide to scams; VirusTotal's description of how it works; ICANN's Uniform Domain-Name Dispute-Resolution Policy and lookup tool; WIPO's domain dispute fee schedule; and the FBI's Internet Crime Complaint Center, all as read on 21 October 2026. The game names in the table come from those reports; the real games' own pages were not checked. The statements that a fake can lead to false positives for the real game and that a hijacked developer account is the most convincing lure are general description without a linked source. The order of steps, the player statement, the view on domain disputes in section 7 and the advice in sections 8 and 9 are our own and are marked as such. It is general information, not legal advice about your situation.