“Can you test my game?” Fake itch.io pages spread hidden malware to gamers

Fake itch[.]io pages are being used to spread hidden malware to gamers, withlookalike pages that mimic legitimate indie game layouts and a download button presented as a test game. According to Stefan Dasic, the lure often arrives via a DM from a friend or compromised account, using familiar hosting and UI such as Blogspot subdomains or cloud links and sometimes Dropbox, to appear trustworthy.

When clicked, the Setup Game.exe acts as a stager/loader: it launches a stealthy, memory-only script, spawns PowerShell with an encoded command, and unpacks a Node.js runtime and other tools into the user’s cache before attempting to download the main payload. The attacker may even close browsers to suppress alarms, and the campaign includes indicators of compromise like unusual folders such as C:\Users\<you>\.cache\pkg\… and %TEMP%\xlfvhkx3\….

If you suspect exposure, the guidance includes changing passwords, enabling 2FA, revoking sessions, and running a full Malwarebytes scan, with a reminder that Archimoulin is the real game being impersonated. 8 October 2025.