Kids, students, and gamers: fake itch[.]io game updates can install malware

Who may be targeted: Children, students, gamers, parents, teachers, and anyone downloading an indie game, update, or playtest from a link shared in a Discord message, email, social post, or gaming community.

What we are seeing

A GitHub Pages site at jessellis95[.]github[.]io/update/ copies itch[.]io and offers a password-protected ZIP as a game update for Windows and macOS. The archive contains malware, not a game. Its macOS instructions tell you to paste a remote command into Terminal and enter your computer password; the Windows download contains an obfuscated executable package. Do not download, extract, run, or follow instructions from this page.

Warning signs

• The page uses itch[.]io-like branding but is hosted on jessellis95[.]github[.]io rather than itch[.]io.
• It calls a password-protected ZIP a game update and provides the archive password on the same page.
• It offers separate Windows and macOS downloads and tells visitors to extract and launch them.
• The macOS instructions tell the user to paste a remote command into Terminal and enter a computer password.
• The Windows package is not a normal game and includes an obfuscated executable with random-looking names and large random-data files.
• The download or playtest link arrived unexpectedly through a gaming chat, Discord message, email, or social post.

Reported addresses

Written so they cannot be clicked. Do not retype them into your browser.

• jessellis95[.]github[.]io
• 192[.]162[.]199[.]249

← All alerts