I am serious. The amount of fake projects is scandalous. I am talking about indexed projects that are unchallenged for months. And even reported projects stay unquarantined and sometimes indexed for weeks.

Most of those things are uploaded on obviously hacked accounts. The problem is not something simple as a try my game on discord scam, where you get a password for a rar archive. It is the let's browse shiny new games on itch minefield. The malware will take away your itch credentials (cookie theft) and not even 2fa will protect your account. And who knows what else they do.

Since some of those hacked accounts have had payment options, some of those scams have pay what you want active, sometimes even paid only. They have fake ratings sometimes and sometimes are not reported, so you can encounter a scam that is half a year old or older.

Fortunate for many players, the scammers most often target adult games. But I have also seen regular indie games, that were released on Steam.

So if you are unsure about a game, trust your scepticism. And if you are sure it is a scam, report it. I saw games with comments about it being a scam, but apparantly the users did not bother to click the report button. The scammers are experimenting with all sorts of variations in their publications. And this sometimes includes impersonating the original creator by linking sites of the original creator.

Oh the games might be real, but at the very least they are pirated, and at the worst you get infected with malware and as a bonus your itch account is used to spread more malware.

General tipps:

If it looks too good to be true, it probably isn't. Seeing a finished game here for free that is paid on Steam? Obvious fake.

Use the itch app sandbox mode. Or create your own sandbox mode (use the internet to find out how. It involves creating a new user on windows that has a password and starting the not yet trusted app as this different user. This way at least most of your stuff should be safe-ish.)

One method of detection avoidance is to not have the malware in the downloadabe, but prompt the user to download additional stuff.  So be very suspicous, if you have to download other things. 

While some legit games do provoke a warning message from antivirus, guess what a scammer would tell you about that message. Right. Never trust an unknown person on the internet that tells you to shut off your protection. Triple check, why the message appears. On hopefully rare occasions even legit devs could have their development computer hacked and they unknowingly uploaded malware.

There are many red flags and some green flags for games. I shall not talk about them in detail, lest the scammers upgrade their schemes. But if you regularly browse new games, you will notice patterns. Be careful. They do also appear in new&popular. And in popular if you select tags with few hundred games.

But the best green flag is a game that is alive. Not old and undeleted, not having a dozen fake ratings, not being posted on an old hacked account that still has followers and even payment possible, not having several games posted in a few days, not having links to patreon and twitter, but alive in the sense of having an active community and surroundings. 

---

For any admin reading this. I collect them in a private collection. Accounts get hacked right and left. Please do something, anything to protect the users of this site. Whatever you are doing now is not working good enough.

https://itch.io/c/3438002/spammers-reported

The collection above grew by like 50 items or so.

It is disheartening to see reported accounts publish yet another indexed game a week or more after being reported.

Or see original games here not on the index and the fake getting indexed or both appearing in search.

About 80 games on my list still exist. Oh, the older ones might be quarantined. But you can still download them, and the malware spreaders could use direct links and tell the gullible player some story as to why that message appears. It is not unusual to have false positives for indie games.

Whatever itch is doing to protect their users, it is not good enough. There are demonstrably several hacked accounts every day. It is as if there is no account protection whatsoever! And who knows what happens on the hacked systems. I have doubts that the payload is stealing credentials for an indie gaming platform.

And I shudder when I think about all the old scams that went undetected. It is a minefield.

And I shudder when I think about all the old scams that went undetected. It is a minefield....

The last weeks I saw a few that were over two years old. Sitting here, unprotested, waiting to infect a new unsuspecting user, trusting that a 2 year old game on a legit platform like itch could not be malware.

A minefield it is.

I am tired. My collection of abuse of Itch's service has over 500 entries :-(

And there is not any sight of improvement of the situation. Not only are most scams on hacked accounts, - let that sink in for a moment - Itch takes too long to act upon reports. In the meantime the scam pages get indexed on actual internet search engines. Some even garner followers on Itch.

If people look for games, Itch ranks very high in the results. Just recently I found as result #1 the Steam page and #2 the scam page on Itch.

There are different kinds of scams or shall I say malware delivery schemes. One nasty bit I saw recently used a children's franchise to promise a game. I would very much like to know how long the acceptabe timeframe is, to remove crap like this after a report. And as a hint, there is a filehoster that does this within an hour. And google & co will take also a few hours or less to feature scams on their search results. So how long?

I guess the scammers use some loopholes, but still, something should be done. How many hacked accounts are acceptable? I would not beat that drum so much, if the scams were just posted on fake accounts. But seeing them on hacked accounts is heart breaking.

Oh, and if I look at scams and non-scams and their gain in followers, there obviously are many people mistrusting the scams. If you suspect a bad actor, please hit that report button and write to itch why you think the project is fishy. Their automated systems obviously did not catch it, otherwise it would not have been indexed, so they need to get reports on the scam. I really did see some scam indexed for months with people talking in comments about it being a scam.

It currently is better. I hope that sticks and means that Itch catches them much earlier, and does not just mean that the scammers hide the scams in other ways or other places. Or are on a holiday.

Automatic checks can only cover so much, so if you have reason to believe something illicit is going on, you should report it with your reasoning.

Just a reminder, if you do not report a game, do not count on other people reporting scams and malware.

This is why there are uncontested malware projects for weeks, months, and longer. Just the other day I stumbled on one that is out in the open for over half a year R-107095. There even was a recent comment on it, about the "game" not working and naivly asking if it is a virus. Or this one here is "only" four weeks out in the open R-107159

Project age alone is not a green flag to establish trust.