How it plays out
The scammer either takes over a real account or creates a friendly-looking new one. They send a short, casual request to test a game, sometimes offering payment or a gift for feedback. The download may be a zip file, an installer or a file with a password so security software cannot scan it. When opened, it may show a fake error or a basic game screen while it quietly collects data and sends it to the attacker.
Spot the red flags
An invented example of how this scam often reads. Tap the parts that feel wrong, or reveal all 4 flags. The sender and addresses are invented for teaching; please do not type them into a browser.
hey! me and my mate made a game, can you test it1 for 5 mins?here's the download, password is 25802 because the file is bigif windows says it's unsafe just click 'run anyway'3, it's not signed yetI'll send you a gift card4 for the feedback :)
- 1
can you test it
A sudden request from a friend you have not spoken to in a while is a common sign their account was taken over. - 2
password is 2580
Password-protected archives stop security software scanning the file. - 3
click 'run anyway'
You are being told to override the warning designed to protect you. - 4
gift card
A reward for something trivial is bait.
Red flags checklist
- A request to download and run a file from someone you have not spoken to for a while.
- Spelling and tone that do not sound like your friend.
- A password-protected zip or an installer instead of a store page.
- Instructions to switch off security software or ignore warnings.
- Pressure to try it 'now' or 'before the deadline'.
- A slick game website with no real company details, no store listing and a domain registered recently.
If it happened to you
- Do not open the file. If you already have, disconnect the device from the internet.
- Run a full scan with your security software and follow its advice. If unsure, get the device checked before using it for logins.
- From a different, clean device, change your email password first, then your chat app, game and other important passwords.
- Sign out of all sessions on each account and turn on 2-step verification with an authenticator app.
- Warn your friends that messages from you may be fake.
- Report the account in the chat app, and report any money lost to Report Fraud or Police Scotland.
What a password-stealing program takes from a PC
Malware of this type is often called an info-stealer. It does not need to break anything to be useful to the attacker. It simply copies data that is already stored on the computer, which can include:
- passwords saved in web browsers;
- browser cookies that keep you signed in to websites;
- the login token used by desktop chat apps;
- files from the desktop and downloads folder;
- details from game launchers and crypto wallets.
Session cookies and tokens are the worrying part. They can let an attacker use an account without needing the password or the 2-step code, because to the website it looks like you are still signed in. Discord's guidance says changing your password invalidates your current account token and logs you out of all devices, which is why a password change matters even if you have 2-step verification.
Why the message comes from a friend's account
Once an account is stolen, the attacker sends the same message to everyone on its friends list. A request from a familiar name feels safe, so more people open the file, and the chain continues.
That is why the most effective check is outside the app. Text or call your friend and ask if they really sent it. If their account has been taken, telling them quickly helps them start recovery and stops more of their friends being caught.
If you are the person whose account sent the messages, follow the steps on our hacked account triage page and post a short note to your friends from another account or channel once you are back in control.
Change passwords from a clean device, not the infected one
If the malware is still running, any new password you type on that computer could be captured too. Use a phone or another computer you trust to change passwords.
A sensible order:
- Your main email account, because it can reset everything else.
- Your chat app account.
- Game platform accounts and any account with a saved payment card.
- Everything else that used the same password.
The NCSC recommends a strong, separate password for email and suggests three random words as a way to make long passwords easy to remember. After changing each one, sign out all other sessions and switch on 2-step verification.
Once you are back in control, look through each account's list of authorised apps and connections and remove anything unfamiliar. Some attackers add their own app connection so they keep access after a password change.
Getting the computer back to a trusted state
Run a full scan with up-to-date security software. On Windows, Microsoft Defender is built in. Then check for anything unfamiliar in your list of installed programs and browser extensions.
Some info-stealers remove themselves after sending the data, so a clean scan does not mean nothing was taken. Assume anything that was saved on the computer has been copied, and act on the passwords and payment details accordingly.
If the device is used for work, banking or holds important files and you are not confident it is clean, a full reset or professional help is a reasonable step. Keep your devices updated afterwards, which the NCSC lists as one of its basic recovery steps.
Genuine playtests look different
Real independent developers do ask people to try their games, but there are usually signs of a real project behind them. A store page on a major platform, a public playtest signup, an itch-style project page with a history, or an official community server with moderators all leave a public trail.
A genuine developer will not mind you checking. They will not ask you to disable security software, send password-protected installers out of the blue, or offer a payment for five minutes of play. If someone becomes pushy when you ask questions, that tells you what you need to know.
For more on files disguised as useful tools, see our page on cheat and mod malware.
If you are unsure, ask the developer to publish a build through a public store page or playtest programme and wait for that.
Settings that limit who can send you files
You can reduce how often this kind of message reaches you. Most chat apps let you control:
- who can send you direct messages (friends only, or no one from shared servers);
- who can send you friend requests;
- whether messages from people who are not friends go to a separate requests folder;
- whether the app filters or warns about potentially unsafe content and links.
On your computer, keep your operating system and security software up to date and use a standard user account for everyday use rather than an administrator account. That way, a program that asks for full access has to ask you first, which gives you one more moment to stop and think. Our Discord security guide lists the relevant settings by name.
Questions
I opened the file but nothing happened. Is that a good sign?
No. Many of these programs show nothing, or a fake error, while they collect data. Follow the steps for an infected device.
Will 2-step verification protect my chat account?
It helps against password theft but may not stop the use of a stolen session token. Changing your password logs out other sessions, which is why it is an important step.
Is a file safe if security software does not flag it?
Not necessarily. New malware may not be detected straight away, and password-protected archives cannot be scanned. Judge the request, not just the scan.