Cybersecurity Reach Foundation
← All safety alerts
investigatingBrand: itch.io

Kids, students, and gamers: fake itch[.]io game updates can install malware

A GitHub Pages site at jessellis95[.]github[.]io/update/ copies itch[.]io and offers a password-protected ZIP as a game update for Windows and macOS. The archive contains malware, not a game. Its macOS instructions tell you to paste a remote command into Terminal and enter your computer password; the Windows download contains an obfuscated executable package. Do not download, extract, run, or follow instructions from this page.

A dark game-download page using itch.io-like branding and offering a password-protected update archive
A game-download page imitates itch.io and offers a password-protected archive. Do not download or run it.

Observed domain or link

  • jessellis95[.]github[.]io
  • 192[.]162[.]199[.]249

What to do

  • Do not download or open the ZIP, even if it is described as a game, update, or playtest.
  • Do not enter a password from the page into an archive and do not run an extracted Windows program.
  • On macOS, never paste a command from an unfamiliar game download into Terminal or enter your computer password because a page tells you to.
  • If you downloaded the archive but did not open or run it, delete it and empty the Trash or Recycle Bin.
  • If you ran it or entered your password, disconnect the device from the internet, tell a parent, teacher, or trusted adult, and get help from a qualified technician. Change passwords from a different, clean device and revoke active sessions; protect any cryptocurrency accounts immediately.

What this alert does not establish

  • The page operator and number of people targeted were not confirmed. Do not reproduce or execute the embedded commands.

Share this warning

This alert is also on WatchOut, our shareable alert feed, with one-tap sharing and free email alerts.

Observed:
Last updated:

This alert is maintained from the shared Cybersecurity Reach Foundation / ScamArchive alert record.